e93cf7c4...3775 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 93/100
Dynamic Analysis Report
Classification: Dropper, Rootkit, Spyware, Downloader

e93cf7c4f464ff015bda21fed805744beaf2d631ccd7cc81eb8a434a5bc73775 (SHA256)

adobereader_dcupd_en_cra_install.exe

Windows Exe (x86-32)

Created at 2018-08-28 10:26:00

...

Notifications (2/3)

Some extracted files may be missing in the report since the total file extraction size limit was reached during the analysis. You can increase the limit in the configuration settings.

The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.

Code overwrite was observed during this analysis. Note that the analysis results may be affected by this modification by the sample.

Indicators

File (224)
»
Filename Hash Operations Source
\\.\pipe\ToServer2564 - Access, Read, Write
\\.\pipe\ToServerAdvinst_Estimate_C:\Users\EEBsYm5\Desktop\adobereader_dcupd_en_cra_install.exe - Access, Read, Write
\\.\pipe\ToServerAdvinst_Extract_C:\Users\EEBsYm5\Desktop\adobereader_dcupd_en_cra_install.exe - Access, Read, Write
C:\ - Access
C:\Config.Msi - Access
C:\Config.Msi\ - Access
C:\Config.Msi\30de6.rbs - Access, Read
C:\Config.Msi\30deb.rbs - Access, Read, Write
C:\Config.Msi\MSI2243.tmp - Access
C:\Config.Msi\MSI3162.tmp - Access
C:\Config.Msi\MSIA607.tmp - Access
C:\Config.Msi\MSIDF41.tmp - Access
C:\inst_fold - Access
"C:\inst_fold\waitbefore.bat" - Access
C:\inst_fold\7za.dll MD5: 4ca574943165d792efadffff193a5395
SHA1: 282c147dd34ec7bb7d5631ea25c69b656b3f1d62
SHA256: 7f1e0ea1984aacaee736f3082560d53f3e990b44d6e5d2b9ed38a148de79a0fb
SSDeep: 3072:8xDDNhSGkz5e5cfll2+NkqXGJFGOm26C2zIvr1FnYzyrnJEYAAAAA+hIefckRQEH:R6Wl20LA4OBrn+NedRO7xn3T
ImpHash: 38f58790f948beede26333a80264786c 		Access, Write Created File
C:\inst_fold\7zaa.exe MD5: 0184e6ebe133ef41a8cc6ef98a263712
SHA1: cb9f603e061aef833a2db501aa8ba6ba007d768e
SHA256: dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229
SSDeep: 12288:rmJysC11szmzqS/Vf3gny3MhcGsnWrfATfkeafIO3rn1ExwnZE1f:r9s/zmT/my8zoW6ff4rn1ExwZE
ImpHash: 97afb108b72a3d7397a41aa475152d5a 		Access, Write Created File
C:\inst_fold\7zxa.dll MD5: 4d183847804e733fb6a197e24272e870
SHA1: 11a11deee65803c75fffb496f91494e6e1e4b7fc
SHA256: 7f964a73d3bd666a494b6eb82aa984bc0b4e77172a78aa4be786d9a578103224
SSDeep: 3072:TYpNRok2PQFDTQQYvanxOokAAAAA+cQKiG3iral6W60b:ahFDTQdZG3zUW6
ImpHash: 467a4f27a756068709b9c07e77c781ff 		Access, Write Created File
C:\inst_fold\arm.7z MD5: 7874c4ad19fbed665ed3e6b8d90a009c
SHA1: bffa277a7329622d9fdd95e7c2fc2acaae788cc7
SHA256: 82db7c2be6139244569f2b0661c3960c8dcfaf00280ac4f98d07a5dbf798c6b5
SSDeep: 196608:4jzRE/T/wS/db6xrQf7MPif9Bhf1W2vDpjsA+xwYCCxOhR9CBAaz5jC4k6CW0O:iY/5J6xriMPilv1W2vDpqxKCxiR91qka
ImpHash: None 		Access, Write Created File
C:\inst_fold\armdaemon.js MD5: a775e77402b091d79af550297e884cee
SHA1: 18589c483d0ce11d2f9332a0c70f8d18a65e1f50
SHA256: e551a009d48db940818b9d5199638a1552c36533d3a81b77bb7fcb9601577f60
SSDeep: 3:qxLtdxFY/iMIzvnjjbxQzCHkxLuALd/LVBsOOTpeqK3xLnLjvUyhc7l1K3xLqxAQ:qvVnTvjj6CHAzd/pB3OT5An/vKlcdKAQ
ImpHash: None 		Access, Write Created File
C:\inst_fold\armfix.reg MD5: 6db860145ae50b5e375081c013ea7365
SHA1: d9796e00553fb8ede91a4ea4fd54bd2166cac7a8
SHA256: ae8590919e2b31b0d20ae3c60c1d3eb897e1ec099b0e04a5c134867af6d88996
SSDeep: 192:78YpGSArpJQU0bUxFgpPUJP2yUXNypyZPyQ7TOd9ShKF/Tybr/vba5IlUx8pV8Ad:789rYEzP29NBnzTisGctbh8q1
ImpHash: None 		Access, Write Created File
C:\inst_fold\armforce.exe MD5: 9245b8ec3d40d640e5cf5183f49ce2f6
SHA1: 958bd732f9650abfee5861141b7cfafd8ff72717
SHA256: 9d40cee14ba2375d57bc18d8492368483b28f7639d742523f797857990196ffd
SSDeep: 24576:Iu5PPVfiM+HMHy4p7k8HOEDh+uQ5E3h36M:Iu53Vfkoy4p7kA
ImpHash: e8dfc5ac7de7059a69d3ffe63e56852c 		Access, Write Created File
C:\inst_fold\armgrd.bat MD5: d833294a72a08af29ecbd2e08ccbfa57
SHA1: 5edafdc1de263f545e04bdc0a9b8252fb3de94c8
SHA256: c2acf0a62ecf18449fe1c503eec18371fae1c50727796bd223df764c190dfd93
SSDeep: 3:7qlKjk/1JqWkcSqVXKV/lglkSizz:+2IJ7kcSq9KV/lglkSizz
ImpHash: None 		Access, Write Created File
C:\inst_fold\armsettings.bat MD5: 8e8d34abd3bc8eefff1e3124acb81dd5
SHA1: 3467220a315a1af9228a13d442ce27e3da28ce28
SHA256: 7c1615e7505593d6a3532b01d224c64a2411b1208d7614db4052398c86811d68
SSDeep: 12:DL01Jf0Z8Jf0wJeKZ8JeKCkH+VM1t2LJ10J19NLKJ19AgkLetVj/+ga64q9V8qxM:DLKZjZlaqkeVMMb0bfKbexCtVzxaTq9w
ImpHash: None 		Access, Write Created File
C:\inst_fold\armstart.exe MD5: 38513031ebf24a4f9961513b0e088e4a
SHA1: 04b813c1dbd1321dc24f52867c73dfcaf37db7d6
SHA256: a00f943d7883bf34102ebf764250dd36c036eb9fc6b606e84513ac1a1a5a571d
SSDeep: 196608:B9dkmSzs6GGrkjQBpsBkpCJ8PlUPRuqMpudfoWtz4:B9dkJsyrkupvp2udiq
ImpHash: c769210c368165fcb9c03d3f832f55eb 		Access, Write Created File
C:\inst_fold\armstatus.bat MD5: e85383ce681bf253025cc35d74e4c97e
SHA1: aa0dbec35fbc4fd6e2530607f3dae0e6c2bd55cb
SHA256: fce121b3b55141f85c1004b11776daf0b9c1d226dbe5163927c26fe0e27204e1
SSDeep: 12:j24zsRMT0y0xZrWl6gow6uaJImzODjVaRMT0y0xZr12dEYc02kndHJ:l4MaMQtLbFaD8MajsEYmkD
ImpHash: None 		Access, Write Created File
C:\inst_fold\armstatus.exe MD5: 536b8e509b970ffebf115c66d6af7e3c
SHA1: f787d8b4a4716e13220d89940c3ea69868114fd9
SHA256: 938efd3a6e96d296b3404c3f3e653a86aeba671c9747ce13c6c14ec2101428b9
SSDeep: 24576:V9c/ardILiw+ygSblvB6QWi01cfPvwuQ593h3eN:VO/wdIAYxB6QWPE
ImpHash: 6d5613449d9401e51320206726768c75 		Access, Write Created File
C:\inst_fold\armwake.lnk MD5: cf958df8cf3bc7cbfdb0d49b40a8b972
SHA1: 7f7c6e90b12ae01309b88f91efd6499ed67cf7c3
SHA256: bc68e8a098137aae47c7a602ada1ba612df4d628ccb0db8fe155df2557769fcb
SSDeep: 12:81SS+csIXKRlUPUa/YQvBJjA+TekQABdEHQv8p:81SBx8PUa/Nv7AEekQArWQv8p
ImpHash: None 		Access, Write Created File
C:\inst_fold\fp.exe - Access, Read
C:\inst_fold\waitbefore.bat MD5: 4cbe466d2b15ee4997fe7fbd23948f9f
SHA1: d15991cff4dbe40619fc67f9aee107753baa394a
SHA256: f7f833279725977cfcfe274688352ea1f7c8b118bc6d9c30fa22624bfcb1c525
SSDeep: 6:WAFDMP1t0wL0xaXpjuFDMP1zc0wL0xaXpjuFDMP13WN60wL0xaXpEFKwl/n:Wgo0y0xOpu50y0xOpujY0y0xOpEFJ
ImpHash: None 		Access, Write Created File
C:\MSI30de9.tmp - Access
C:\Program Files\ - Access
C:\Program Files\Adobe\Adobe Reader\ - Access
C:\Program Files\Remote Utilities - Host\ - Access
C:\Program Files\Remote Utilities - Host\Arabic.lg MD5: e51a34c8198ba9a59e53f0503777e75b
SHA1: 83d93b4a520b08efa14b55c80c5db8f85d5ca9e4
SHA256: 5810c1f2453156015e43dc8844b8463eaa47be877c07834e67723815aa60c5d3
SSDeep: 384:8uSWZIpfcBVSNiDvZI/BMJkb7/DvVVqx8sjXDtnMKhcD66KnLQ+IpvcuDudd3tzu:oaI5M7rhcDx+LnzBs
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Chinese Simplified.lg MD5: 844e2b8e4ad580ff845402a6b3b88846
SHA1: 1e76d2008eee1a896d207dd9c3c1a504dc9d06de
SHA256: 4d646a6af146c05cdb4644f62605cb40196595e6ed3aabcaf92e7d081c4eebf1
SSDeep: 768:w4ZeAyS/v3c0kjkcpH7O0ne68XPfHynIlxBQk6WoB:fZeA5voj/Y/HHyv
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Chinese Traditional.lg MD5: 420f3450e1dbf4ecbe48125bef79155e
SHA1: eedd628146fe8722aa8f5a9cc9a84ff86bc403ee
SHA256: ac397a585dd2e48f8ee01d2e50d4d87e138d24d6f6f7c442507feab796c3a9ed
SSDeep: 768:YP1tFWwXC1a0ogJWbXcTRB4N24nXX3G6FnVxCn3be+4:Y9t/C1atb1XHG6qU
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Czech.lg MD5: d39727c9980021059a0f2073277e039e
SHA1: a59b8f6d517741a8cf8c88cbb9bc7ddfa8879f75
SHA256: f1900d97610996e7a71c354f3899c26324e5a5493374a4d697558e4c4f669257
SSDeep: 1536:O0vOy1dWVToDCWJRxHHO4hspLBPxrEXvLZJKQn6TYbjL6bgC+cYP2k:O0vOy1dWVToDCWJRxHHO4hspVPxrEXvd
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Danish.lg MD5: ab723f51a48801456d39bb48396beada
SHA1: a721d0afa24cbfb99c97431be42113426ab6638f
SHA256: 3db7b110d7df4402b0ac207d28debb735cfd476ef42c2f71bbba5108a0b96da5
SSDeep: 384:gT1z3OH0gvqC4T1AIP28VpsjIvAAcs1jrnLA7lFTt9jMAlI4r:DHqTv5jruTtD
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Dutch.lg MD5: 00c905e8da73cf386c210d28e3797f6c
SHA1: 512b1c68ad520bbd77733cf71e376333c509c183
SHA256: 83813ca174f76a126e05f6cca58be24ce2a48a2632e9bf6bfa46a353d01111b6
SSDeep: 384:SKgzSDh81zMEAgcj6Av24RMDQDLXedTvjq0RjD8ZbK6BmmhWYpjUwkQZQuxtWv6M:SY21zVg+aeq0Rv8ZbnTFaObLfWucLOmD
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\English.lg MD5: 6396e5ade56e4f45c4f59ca210385f58
SHA1: 88f8778e8f960001ee558255e22418d8ea17446a
SHA256: fe57254a0c2a3593d618bea7d43074c7b637ec3021f0b51073c0d95f65bae882
SSDeep: 384:bKrZjali4EH/1NesnYQ90NfOgisWZBAosFwmlefDYsOsFPJjs1TqjB:e22TZGvlefH7x
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\EULA.rtf MD5: 722fe688f60b4649265f5177a8c0c0ca
SHA1: 9532e0de2b2d1eeacc19f15602904ae14231df6b
SHA256: 2e551329bf8cb93e665c17bac916776d75091ff190b7ccff8a48fb0de0d582b5
SSDeep: 384:p7hqMNkNVhaaU1/6tMIENPtQXj9/RXGMQchPmP9tjkJ7Olh2uk4wYi6rGs85sxX5:p7qZMIENPkjdR2MQchuP7jkJN/dsxyu
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\French.lg MD5: 7c2276331e1e744cf702858fbb041039
SHA1: a5c7c0067a96b7e8cd11d8b3c205494147a2da4e
SHA256: 0b05f6ada359e0c3295d32087874bf2888e60400fe3a9ec4d54a849031bfe915
SSDeep: 384:uGTDMQmpXpiwV+Bcp7D6AfZbKrHt/Adyu+AFeM12yATQHwUZAOqSA+lFS:PC1X2gyO13HbHY
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\German.lg MD5: 42b83b0d09167cb42582b5f830b44ebb
SHA1: a9d5d467643aca034a983ebbb595d2fedd19062a
SHA256: 56b73a451ecc9d3f99892b397ef1b5006b6f9296765d01fbdc7fc3d979400bbd
SSDeep: 384:BWOrmAW/HVZK8sEy8hsNrcbzfwA/AlcLwhi55cR5WC/N4JdGy2TSZEQiNtp34hBc:pXW/0rcbjtlwhJR5j/2JdF2WeNtp3etS
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Hebrew.lg MD5: 516352f3ff5dc96d8cfbd6abf069aabd
SHA1: b52524bec89b956fba232d7a72205e63e029d5d0
SHA256: 6387f12ff599445016b7f5b191170f077fe50c8b986a7d9650abfb7ccb6377f5
SSDeep: 384:XncbAZHwCIo7HKInFzEnac+Q8ZUUBIbN08bZavbiSoBV205ZT1xD1O8Vcm+yWQRJ:m8QSQp7hNRMho9H
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Italian.lg MD5: dfcc06cd5e145a631806c1d011ad0fba
SHA1: d53236889246db20ad22f4811d24c7257c9b635d
SHA256: 9848f250729fe0a81118aa027592ad0ef98d8428e808fa7bafa0903a93c4d94b
SSDeep: 384:Sm01Cwq1dgmzJFUr8jmu3xwZBdGsWbITzqlf288Fuz2O5qi4NZhhia2nQec7b8wH:EkcIzSiGwarec7IDVmA8eY
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Japanese.lg MD5: 58319662af8f62390737c9df99f23dba
SHA1: 19d0549605e76343555a3486aac9b072fe47e878
SHA256: 4df73b25972b4388f2ffe70b88d4cfc739aed58dc0a72163b96cd407eb8d4388
SSDeep: 384:FOcgi7ScbYvKxPLpAgwCMH9yL/VcdnQZfGl/8gUeFmNyEQvxQpdX2vSV:llQKxTpAgcIu4f8UeLqV
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Korean.lg MD5: dc4e41d98050548860bf92ca11345962
SHA1: 259fc2aa4622e202799bbb5d352e57da47a6988f
SHA256: 87ada3f861a2b04e39f633218b791cc9e08200dafe96b85538c2ce402fe1f0db
SSDeep: 384:Xj+dvdrVVSEriZidLa515S7tQKnZ+r8x1ubapR+YY6vviE5z/:yrRILS1bJnd
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Monitor\ - Access
C:\Program Files\Remote Utilities - Host\Monitor\x64\ - Access
C:\Program Files\Remote Utilities - Host\Monitor\x64\drvinstaller64.exe MD5: bf25bed1f6c00110503ae135e500ebdf
SHA1: 4ac12609265f47f75f2cdbe0fa0bf313cfe5e149
SHA256: 5517516030166606f2bdcd34a4990dee896a22be1fc23c700fc16743520c519a
SSDeep: 1536:7UYAqkUIVQaz5e3fdDJVBbM4L6LG1F33AknTZ9IM3eFyINtiR+uqPXJeyr3XLT5S:lA1UIVuNJ3V+kRsoyrXLTvDLS2Ofogz
ImpHash: 59bdbe841821e55833bc6930690cad31 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Monitor\x64\lockscr.cat MD5: a9790fa84c8d1511f3b7f9dc4c97435f
SHA1: 0342a477e0a8779ad05e716f4d563ff676e1b2a4
SHA256: beb45913bc014d70ceb9e061b9683de36fe3d000f425c4df6151be1a37c6fb0c
SSDeep: 192:enYe+PjPJdZubhlCVuuImqAZscF8Bd1LM4L4Zyi:enYPLXZgwgAZsHLM4E
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Monitor\x64\lockscr.inf MD5: a4e8736aa55b109b40c786a637991116
SHA1: 20c1b886361974bcb608a79b2fd7598092ae821b
SHA256: 097c3da78321ac553966d4ebabfe1a533dbb1b383010ebf165eede9c631dc6dd
SSDeep: 48:jshukkXFbsf0tz6Joq7mgHwuMgHPgHKJDWlFVfXj07J:jMYQi6JoimIMsRJDWlFZIl
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Monitor\x64\lockscr.sys MD5: 5ccfe71b2ef1b5df69bf50885b84128f
SHA1: 79ecfa80fb565cb59a64a1d316d52b57ebe2cd4e
SHA256: 6b4e94a66e1325aa746da3a0a34f1b3618a1ab008d9187c604e620e52f8b21ed
SSDeep: 192:fJxu7TS2JihqS+nWvnYe+PjPJdZubhlCVuuImqAZscF8Bd1LcdUf:fPu7YUmnYPLXZgwgAZsHLcWf
ImpHash: a88e45e02fb5413987493e1d3c4a90d3 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Monitor\x86\ - Access
C:\Program Files\Remote Utilities - Host\Monitor\x86\drvinstaller32.exe MD5: 2dc45cbcce2a4d1eb1e28d1d51e53ad6
SHA1: d7a62a73bc27886ed524bc961392038f018c4150
SHA256: f5d93809fdc5912f82201ae5e1626085b5f798c2f4d7c9e5cca7dfacace69d33
SSDeep: 1536:vTm/S/7UOlwFZxYEJTnp6EaGdBVBbM4nQmcpi7EBzSeOYzkOQvvJCoXTZBaCQtnW:8SzUOyxpfznQUokjun2Dr9CYQrLgB
ImpHash: 6990dbbe7c3099ae0f704b8ff1a07aae 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Monitor\x86\lockscr.cat MD5: d3710d7c70cdea8ced943458b2206bad
SHA1: d9851beae95f6035fd074706fccfd9cb8fecbc24
SHA256: 54a00f5913185f05d2011de575da343c64fac54e7a857ab5f066e68ab11368ef
SSDeep: 192:QKnYe+PjPJdZubhlCVuuImqAZscF8Bd1LM4X/g:QKnYPLXZgwgAZsHLM4o
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Monitor\x86\lockscr.inf MD5: 22d30a038b3db6ef939bb05f697eb3d4
SHA1: 7e76546c510fd6a2aab96592f4b1a5a40eca74bc
SHA256: 1f9fe7037c44ba4fd44e15b8cfabe79265331d6ae146045fa15e2c02c6212c1a
SSDeep: 48:jshGkkXFbsf0tz6Joq7mgHwuMgHPgHKJDWlFVfXj07J:jMwQi6JoimIMsRJDWlFZIl
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Monitor\x86\lockscr.sys MD5: fa01dab3229ca22caaa15a245c488f6f
SHA1: 9b8aa9041529aa5c0b1f2fbc0ad73744d95b5ceb
SHA256: e1363e7b917c96a03c74e6e7dfcc1e374b64ef86005e9f7d624cf77b785a85ba
SSDeep: 192:F6/uzfJZBlnYe+PjPJdZubhlCVuuImqAZscF8Bd1LchCt:42zB5nYPLXZgwgAZsHLcIt
ImpHash: a88e45e02fb5413987493e1d3c4a90d3 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Norwegian.lg MD5: 3cdf55746e6889e8fff300e54a287bcc
SHA1: 57c38147c92b86f7bceeb4dbd9ad1d720410b07d
SHA256: d3014f26e0b5bd84f694c8ad18f0de48ce3cbcbaa2f649070f161c64702cae3d
SSDeep: 1536:IzYWB3TwZOFLoAapzop2DL+p/uSAoILpUNW:IzYWB3Tw3XDac
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Polish.lg MD5: da9d399b473ccff29e6e8f9a5723cbfb
SHA1: d878b4206aaf64384162e96673845e913db34c69
SHA256: b885b4e1e7bea7c202c71313a60774143dd7cc18d1a0ec8412b47d53016ea3f3
SSDeep: 768:FlnI42juO0ISxfcndYoIw+hPj6Ewz0EMlkHYoTZ:FZg
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Portuguese, Brazilian.lg MD5: 119f5f60b0d87bd3a9e34eefe510cead
SHA1: 07835dce1a48d571d1e8a5a4ff1f47f44bac3992
SHA256: b9793f0ede71f259dc242c926cdc8f70fdb241a8a0f22c7206fb51b7e0a43002
SSDeep: 384:1ZxUvMzwgsBD5ujNuKXXXx2WGOwZD13jQjgmYc/+nxSIdIJTN/JmG:rIOaupD3xOOREmonxwTNX
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Portuguese.lg MD5: 18e6affb3bee46aeaf86efb1977f358b
SHA1: 0df0b1fb0e3e59bc2f52d2a2bdadd29bf0adebc7
SHA256: c6e7b98ea6fd6bd60d26c46ba6432000cf4c47c5ba137fb63e905cfc2b3d36ba
SSDeep: 768:KBj5qg4szsX0erv9Xp3TV8yz5FJhD1sWnqzFu9nwd49ZJnE:0MYCvd0G3ZJE
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x64\ - Access
C:\Program Files\Remote Utilities - Host\Printer\x64\fwproc_x64.exe - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\install.cmd - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\ntprint.inf - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\progress.exe - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\rup.gpd - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\rup.ini - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\rup.lng - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\rup_s.lng - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\ruppm.dll - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\rupui.dll - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\rupui2.exe - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\setupdrv.exe - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\srvinst_x64.exe - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\stdnames_vpd.gpd - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\unidrv_rup.dll - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\unidrv_rup.hlp - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\unidrvui_rup.dll - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\uninstall.cmd - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\unires_vpd.dll - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x64\VPDAgent_x64.exe - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x86\ - Access
C:\Program Files\Remote Utilities - Host\Printer\x86\fwproc.exe MD5: ea59044d08afd020fa6d5af9e5e7cf5a
SHA1: d6958e403f452fc2d1bf7fcd8b2edc691d935d68
SHA256: 78436d1fef2d60bbe0a693d8425b8c30e9db167422ee8004eb965773ff6c00ae
SSDeep: 1536:0NpkB9q5HeZJobIusCnXTqFC34d9KJ3w4tjBgYf:bPqOobJs8Eoa4tjBgW
ImpHash: c29d9cb1e0887bcf73c166234faf65e4 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\install.cmd MD5: 23ada030ee52b855789e8fb0db6b5c4b
SHA1: 1f5b1274d7f86fbe2675c9c702196711de2a6d50
SHA256: e7ad95fc7303838383f6fddea9615bb70de8579f53e5df581c1557a01c37ce5e
SSDeep: 3:6L6Vm4uWkVm4uW5Bn:g6VmHpVmHiB
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\ntprint.inf MD5: 6476f7217d9d6372361b9e49d701fb99
SHA1: e1155ab2acc8a9c9b3c83d1e98f816b84b5e7e25
SHA256: 6135d3c9956a00c22615e53d66085dabbe2fbb93df7b0cdf5c4f7f7b3829f58b
SSDeep: 192:jxUPudWfG9sPEd5yVplXhzPGeQ6cGIDGzBs+2o5WcicJXoNaTXy:jyxFeGIDIFXoNT
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\progress.exe MD5: ecbe7572b3b6bdf275c51da7e5ca3d94
SHA1: 1af52869ba692bbc04712721b19a1bef5762d132
SHA256: da6104aa160e4861ef3892020fbb9f4966a0bc7280a8c2e4f8d5f739ec0f0cdd
SSDeep: 384:nSZPGL9A2TdR5W6D4+ZSZQwgMSZsHLPK6jH6x:nkP0A65XIg2PKgax
ImpHash: 3f576706ca13a6ace3419e9ac8d63897 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\rup.gpd MD5: 151f3af412abd6bf05d160a70f8873d8
SHA1: 0efcf48401d546ce101920496dcbbf3ab252ee87
SHA256: 4c21b9663120b494d0f5112eb5f9e0aab4b659a5bf5d5301ee4d5a98abb20f25
SSDeep: 384:U1EQCc2g2N2A2X2Y2j2+2BgQzaZah25Dy:3RLormTqdB1aZzy
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\rup.ini MD5: ec01a42770693558a18ba4c72d9ada05
SHA1: 484bd82cabc1c6ecc8214b3c8e57258755725d79
SHA256: e1113b0f0daa2ce44dcc01dabfd8bdff21630c724a333868c87fb9822e60ebed
SSDeep: 3:z8ANyq3jIrc:z8cy2Ec
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\rup.lng - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x86\rup_s.lng - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x86\ruppm.dll MD5: fcb5be7562659b998cdd84a1eecc1532
SHA1: 519cfebeb99981f8a58ae44ea47a361fd1fcd4f1
SHA256: 524209869f6428f5c2da7f8a3c18fdb4f028a553f9ef2f09cbc4ab7743b31c5b
SSDeep: 768:639rZiJf4Fqj9IarpbsMUxbkTKkl+CvtZLkVSXUopD2PGos3+U/g2PKgDvWr:Hj9IarpbsMUxbWKGztZoVSND0z2ZgYpg
ImpHash: c5ca745c42f3ee330e9cb6af79e7b9b2 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\rupui.dll MD5: 06fbee958a668325bb760204e70563cc
SHA1: 5f364d4c80eddc1b2e286ea6fa42898eb0171a9d
SHA256: e3cccf9d3d72d446b375b1ddc99c54aeb0bb303f4580ae5541886bb2ab36c12f
SSDeep: 768:WmK+cIcN08XOJVrPULt1gvshDE0qmYl47g2PKgY:6+BcNXeJV0DlB7gY2
ImpHash: 09eb4d4465f1d6e5c469dd0676d5e56a 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\rupui2.exe MD5: 65c68866b4d28bf39f96143ec40957de
SHA1: c24c1c8323e4a99a3a4c0cc164fb8b62ca0bc0ce
SHA256: 8e663c200e585c094695aa2f3eb93be28708d0a555e9fe372bf0adab6ab6c81b
SSDeep: 1536:rHNLMFvAoLVe7SYJ4dt9W73Ghsiwje8yHPNbIxTT7sqFLE/o0vqaXaO/taOrAjKJ:rhOvZYQ7WusiFvNboZwTT/taOQU1gk
ImpHash: fae980a92b4d012988f8055419fd577b 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\setupdrv.exe MD5: e6fad6f55219253a16fe5bb92c80ce15
SHA1: 01a34aa45c1cebe15fddc5b1f73848228b9a2436
SHA256: 57ebd191c1a040759be022480bc8d11fc3f3bc3214343b99c95ddf3eae47f5d2
SSDeep: 768:kA7DDwprhlrMKK9jfcKk5NijGA/z0TIx0PqfyljmkjxOarHg2PKgV:kcHcViK0r0a7xOlOarHgYv
ImpHash: f3fe72f20e63d95f71d7b92ec2b8b9a4 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\srvinst.exe MD5: 79426fca71d40afb2d439574a716c07b
SHA1: c1015f2f39854df8db6ab2d5266fa5cdf1a0a90f
SHA256: 4bfe323c5b6fe21dc3247b764a6eb22d3ee8f682a412e99cb396f70153f0d014
SSDeep: 1536:PRanzPJhmWbR0e1/lbCV2bbtKb4Q08dNT7Itpfh+vtq1gYy:IzPOa0e195bt8pRAfhgtq1gf
ImpHash: bece82b9d86d5505372b61f51b640b2f 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\stdnames_vpd.gpd MD5: 5da53abe26e7dec28f2596a508068f69
SHA1: a2f08b02c15be2a75045696499a50eccad2f0972
SHA256: 67fefe5e8ef784f61cd6bfcfaa65660d76b12aadcafdd444e54fb74dd3a28bc3
SSDeep: 96:yDkcq9LThAr8J9cogg/QbzUToVPgOOetxM3AzEzWb:NjThm8JC986ITRCzEzc
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\unidrv_rup.dll MD5: 06bcbd5ebae3130b47c5ef8d9566df15
SHA1: 0e908eec1e77c96b1f83ddd42a678944b605fa47
SHA256: df33f57c24dcf3d878d545906f452b2ce691452350b72fc19c42a04a79b2bfc2
SSDeep: 6144:rplBo/TK5C+psQzJzCSX6hjg+4GRr3CoA7f3j5G+hinZ5P31uGX7Zum8oyk7lATH:X0/djgEUhWnJ2UlxqOttoICvPn/318SN
ImpHash: fd0e2200e8478a87b0a698bb3ddd2cfe 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\unidrv_rup.hlp - Access, Write
C:\Program Files\Remote Utilities - Host\Printer\x86\unidrvui_rup.dll MD5: 5068f38eb382ad52f03a77b3848fa3ed
SHA1: 3b8dedceeb87b9a8b577767a581e0101efaff067
SHA256: 5d8b6fb32894d41d2fda5a22c755bdea5864eb7078cec0943da474a8f24e2c04
SSDeep: 12288:PlIoM3g2e9Bg7Lg3yfKDPc97QpAxuKdwSGnZGxKW:PvM36KkyCLW7QCwSGoKW
ImpHash: 532de90578d99e25b70c809372f4b28d 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\uninstall.cmd MD5: 2c6ec773a407fd9bcba6fd1a273912c9
SHA1: 1fe0b0b8dd115fa853e193c4d6cc8882992cbdaa
SHA256: ad608f5672b2310308bf84919d4e2202a53e99854a4a0945ee38bacbb6ef8e72
SSDeep: 3:GKW3CvTzIcLW4NvaLuA:vsCvocLdNvAuA
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\unires_vpd.dll MD5: d9da1c64400ac31989dcb7f37a1c0994
SHA1: 6357f03b367dfc75575da5e8092fe7da28703c4b
SHA256: 42153140f3cb25ed59444703e1ebd004dee97209fc9ac91ae4823290bcc86ce1
SSDeep: 12288:SkoGBEoNh3bBPc/s4430ye84TF1dbua5TVhRre3kf8IKHgikinL5+:2GBEGbL4Np84TQazCSiR5+
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Printer\x86\VPDAgent.exe MD5: 99f58392eaac2a939c74063f654ce047
SHA1: f92473806edb447cc5387739adbc293a5eb20326
SHA256: 1ab16655e3f91d66667b62319d735f334191f9ff66d0bd1dcf9437221438f584
SSDeep: 6144:0RfBITBF/zFWCNgzjXZbx/9XDHPnahPf8MmthzSENJbStUwzJgV:cfoBF/zFWCNgzjXZbxlXDHPnahPf8MmH
ImpHash: 80d9689a7aa35eb094515238492b1be6 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\rfusclient.exe MD5: 848a53dc549be0386e5da0f49700c389
SHA1: e918192d2b5c565a9b2756a1d01070c6608f361c
SHA256: faf0c5e4ef7dbcfd863377c55a4d1d87a3f6a58c13a8a9882e11012066f31976
SSDeep: 49152:fToOPDphyCs76leS+ZdHP0pCDYIHvdddCOQyxdN3AzqT2TNO9jiu5Ky987l:fToOHyCKZ1vdCOQybN3YkiQKBl
ImpHash: 0a3761564752f553c81f2f96521b33c4 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\RIPCServer.dll MD5: 435d9e1fd4b87308f0f91da25530d4ec
SHA1: a9b0c513b930f4c2ef86cb75a8de1fe16eb6d996
SHA256: 05040b677d7697b4f97da173c6c07146d3bde327833fd2022bf2cb67f90389ca
SSDeep: 3072:WvQPgrvHfETaxPSki7FlC+y/DPHSeqqSDUDPBcHnIO3gH:WvQovp07FGaXgH
ImpHash: 088d639a9cd7c3c4bf26cc23aed13933 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\rutserv.exe - Access, Read, Write
C:\Program Files\Remote Utilities - Host\RWLN.dll MD5: 534d6f176f6cbc725f9e7db8028cd3f7
SHA1: 35b53f2e344f4a908a551409d018a91dc58100d5
SHA256: e713f288a46aad762f76c945467bb3ea7c84edfc56cec1c4c1b40d9f919bdcc0
SSDeep: 12288:+EWFAQWGdxKCe/7BL83fQdRQ0TESX+EHjggwPzN:/ZG9e/tLHu0TESX+EHjKzN
ImpHash: 39e3fa7512ea3ee76e55c943ede81a85 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Spanish.lg MD5: 542fb52c74f0f92c5cbe734cf75145b5
SHA1: 6bca28849913bf4f61b3d48791737a00f9718ee7
SHA256: c157ce11631f26462c764bab24b0700f019a2213b36a92002d886d156afa7b03
SSDeep: 384:VLBpSitsBwgxNMJN44gwUnz4j9U+u/ISQh1kSXZC1Zt/bqdDEp9lg0yBrJFuZj6P:FNPaNfWNJcZqwGCYO3S
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Swedish.lg MD5: 6b46297240dfc309a99b133e94c916c3
SHA1: ce4f36af4cbf6ebd15cf6e0e6dc8b72e61872027
SHA256: 88f45f3cc9999a1e35967cd7f33d2d15c0c31b13336fbf93e754e1af8903d9c1
SSDeep: 768:uExwiB90PPNythEEnIzmO250yOXu5sYA4YnXt:uni2PNytCEnIzmO2QXu5sYA4YnXt
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\Turkish.lg MD5: 8a4b15f09ab2301fdbf99acd5274bf88
SHA1: 88bee09f9690dce0f323909d53525f60e076e854
SHA256: 00d3aa64e2afe9b92f2d13255a86eee0f289d9d257229289de0e2020626f0508
SSDeep: 768:aE0cXwLfmn/ft4QtV82UByhgrhfOXXVLbxcmH6Aa7Tvf:aqXw4HRO1fOXXVLbD6Aa7Tvf
ImpHash: None 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\vp8decoder.dll MD5: 381f1b7d8f7da904827980dae02f77a9
SHA1: 81d4d5724533b26391301be2b462f580395d5485
SHA256: f14dab0b9f18aced330729b4a772e6b139817be01783b97b92e9af5fc26615d2
SSDeep: 6144:JIIDyjBnydesbWoiwS7dVIclCzoqHO/gCaEkkH8TuX6RTrWD4siZMZ+LG4IPWwcW:JI8tiDOzyH9H8Tu6h04fZMZoMPuvf8r
ImpHash: 6f14b827deae9e0147bf923b128ca001 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\vp8encoder.dll MD5: 3e6c2703e1c8b6b2b3512aff48099462
SHA1: b17a7f9cce16540b1f0e3dceae9dc7e8e855cb1b
SHA256: 616a0047b5f28a071fc26dd9b0fd90d5110c77a3635565cebc24b6362d8c9844
SSDeep: 49152:iSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSvSSSSSSSSSSSSSSSlwwwwwwwwwwwwwwf:iSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS1
ImpHash: 378381e4872be8b616dde881bf9064fa 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\webmmux.dll MD5: 026d12b240e081794c730c1ed24a6f33
SHA1: bb6c0544ecc2c8db68b23b8e4feab5b3261b4666
SHA256: d639adb51c6e3ee8c249d11eb8db606ba2aa37d4f12f80f2b9685d8f560984bf
SSDeep: 3072:BW218gr7s2yIHB0pTPdTX9zUbEbStE97zjAs1RtTcJTfIv0se7POWu/HgsGU1VTB:BWSfr7sXSmPDbKPJ6/AsNk+ZgAl
ImpHash: 25cf249fb1174de8ba915c4a2462f804 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\webmvorbisdecoder.dll MD5: 2943b9910b1c7cc04024888502885256
SHA1: e2ac697a558fa85ff4c9e2bb114138870a80f146
SHA256: 78115050f4e99372fc10b19a14af60e623ddfda224c8e96340cb5d8166507e2b
SSDeep: 6144:EaoH9sDRlDLD0GDkEp00tc6TKUOmrRK1jRsAOO04sAO88RtwgV:goPH0GgEp0gVd1ValsQXsHzV
ImpHash: 1be1f7011ac5a91d5f33a695bfddf672 		Access, Write Created File
C:\Program Files\Remote Utilities - Host\webmvorbisencoder.dll MD5: 74a8ebf5d8e08e284d734fe5feebd67d
SHA1: 87fb627c6e63eb41e26f389b38d525ccf0c11590
SHA256: 1a9632b9e061b56017d2eb8d15c20e60a9518b4de5faa0399eaba0a17c10045d
SSDeep: 12288:OTAPYZEyRr+NDnaLyx2lz8MSjtX08pYRc29qcQmsGahsQZsbRNeb:lYF+Eyx2lzujtEIYRc1cQmsGa7ONeb
ImpHash: 6aeabf27d25617644e24c000ed77b18a 		Access, Write Created File
C:\ProgramData - Access
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ - Access
C:\ProgramData\Remote Utilities - Access
C:\ProgramData\Remote Utilities\msi - Access
C:\ProgramData\Remote Utilities\msi\68001_{E945283B-758C-4A40-B851-1066D0E49EA8} - Access
C:\ProgramData\Remote Utilities\msi\68001_{E945283B-758C-4A40-B851-1066D0E49EA8}\host6.8_unsigned.msi - Access
\\?\C:\Users - Access
\\?\C:\Users\EEBsYm5 - Access
\\?\C:\Users\EEBsYm5\AppData - Access
C:\Users\EEBsYm5\AppData\Local\Temp - Access
C:\Users\EEBsYm5\AppData\Local\Temp\$inst - Access
C:\Users\EEBsYm5\AppData\Local\Temp\$inst\0001.tmp MD5: cab49c9a9a736317337fe877343483d6
SHA1: c2afc29ced8833786c7b8147dfd5caded1b566b3
SHA256: 9f726f48895110cee07f50e7cb5e85fed787c579c8a77f772b086bcc0fc0ca94
SSDeep: 98304:y1O3TwuO8UCzOnLbVNQrP93EblVidAaakfIbv:y1GUmUVcPyld6Ibv
ImpHash: None 		Access, Read, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\$inst\2.tmp - Access
C:\Users\EEBsYm5\AppData\Local\Temp\$inst\7.tmp - Access
C:\Users\EEBsYm5\AppData\Local\Temp\$inst\9.tmp - Access
C:\Users\EEBsYm5\AppData\Local\Temp\$inst\temp_0.tmp MD5: 9e55e2d9cb3f05e91f3595a72dbe9d4c
SHA1: d07076ddb26fb08e098ba7f31ca930b245ed51ad
SHA256: 71a7922ead2456dffb960e97462019cce2b7058fd64dd7c9abd409daf3100392
SSDeep: 196608:gW2c3gwhxOn0UM0Uyqn6Stt6MNfW9BKzFhBgDwdlzOoxJOh1odBPg149:g/ln0Dyqntt6MJsKzFhBDlzxJ+1o3t
ImpHash: None 		Access, Read, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\7ZipSfx.000 - Access
C:\Users\EEBsYm5\AppData\Local\Temp\7ZipSfx.000\host6.8_unsigned.msi MD5: d5e65d9a0bdbae81a53c7529d8d84ebe
SHA1: 0ded26345926faf919f9c8985e8b7b9f8e9c1b93
SHA256: a15c9de7714dda314144535bb4d3eb34ab240bfaeaae9a7b755a2211e2d96b68
SSDeep: 196608:7J5BzfEU0vFR51DupvqzsuvoYuFZnERejnTamopOYDmWM2:tHkvF3cpvMiVF9HoOYDw2
ImpHash: None 		Access, Read, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\7ZipSfx.000\installer.exe MD5: 3c5850ef227bb206e507551c471ee8df
SHA1: 8943aab98043f28918a0c8d31d7a0076b5bffb1c
SHA256: a803bd4522ec8804adf5e548b2ffc9e3afa7eee179d96945de1a5980b5616445
SSDeep: 196608:6mzxqB4pQOdPLoDzS3lC7FCws+8w05anNfzY+ke8N:6mzxKxS5anNfceq
ImpHash: 8fac1a605c1f7b811be0b9e6913d9c74 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564 - Access
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\aicustact.dll MD5: 6a9c36332255fca66c688c75aa68e1de
SHA1: 2a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA256: 7b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SSDeep: 1536:pysRX1fpScTNumPTXhMw+m3/3Uw5VJdK5KviuWyVstdEpH:jXtpSchuqP3Z5VJZVDp
ImpHash: 231c071429367723c9ac790e87dcf614 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\aipackagechainer.exe MD5: b4f05778c1e9bcf0bcbf0733fd6c763b
SHA1: e0f0a2cf06ed43581fed238aba71eb8bad82cbea
SHA256: 1d6d2d7e16f333759348d331d69b0a5a7e135f4bb9d3615edc59e305341324ea
SSDeep: 6144:/y2Mm/e3Yq28Ra1TdbTLOfPZhK0IJKZJx/d:qLmmLR25bTKfPjWJ+P
ImpHash: 3774cb2cbed58a8a31482e75a7b1c6ab 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\background.jpg MD5: c12b97d5a230a72970b0947ffd1d2ce1
SHA1: f5aa3204ee60f34d736303dbf61f7342f95eaab2
SHA256: 8dfa97d18acaeaa0ed13a43cca6802d5c3637ead536991915ac3d88636ba08d5
SSDeep: 768:v0yNWUFquARfzbOo6CD+NaScnRksCpFMbcJZrhncZ1PoP:MyNBYta3CCVcRksXqXcZ1q
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\cmdlinkarrow MD5: 983358ce03817f1ca404befbe1e4d96a
SHA1: 75ce6ce80606bbb052dd35351ed95435892baf8d
SHA256: 7f0121322785c107bfdfe343e49f06c604c719baff849d07b6e099675d173961
SSDeep: 48:QFFZ+f+zd+kHeNTM9/+Xz++++++++YWWS0i6I:QFFEw4Xc+D++++++++ypi9
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\collecting.jpg MD5: 9a740549bd117bc16f6acb8d884604d2
SHA1: da20e48acde3a7097f8335541de40fe94c600e0a
SHA256: 0daed44a8e14750614afda54781621d400fed0d2ecee9a4a402f5964d3cd3f5a
SSDeep: 48:HJ7nCZOg1kIkRxgPueOXK1HRiVdqx+qZ/FkUD:HJjCR1wiOXK1xMqxEUD
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\completeex.ico MD5: 3eafe3ae99bf33e9f59d970f21ebef39
SHA1: e9895cb920fdeb8907ce37d9666d4999a1de5d2f
SHA256: 5f6c78970ee7e3d668eb8a4acb5d251c76599424a0b0372e7665527516d4c312
SSDeep: 192:lN3tnZnyRZF64hc28fwy+aXE25b6K0FHQHVd42oJ2zwZlaw484:lN37Yai8IaD5T0FHQHg29wZla04
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\customex.ico MD5: 1b5701d7f753135c22cc1ae694ffaf4b
SHA1: 966bdef4159022fcc8740b6eb75b8d7ac4212504
SHA256: aeba695175ed96d3ede9fe30e486df59c64a5fd802c15cb67f55e03a0537cd13
SSDeep: 192:lN3tnFnyRZF64BiTfwy+aXE25b6K0FHQHVd4RhE2zwZlaw484:lN3XYa5TIaD5T0FHQHgRfwZla04
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\exclamation.ico MD5: 93d722fa20a988a5c257a58bf155dc66
SHA1: 30c0d19f02cb39f8804dafe6af483a09c76e2338
SHA256: f587867eed0bec33ef150f3a8525bde9b6746c705543874e56653aa80ea53225
SSDeep: 96:KYvlkFEXFYU2+yCvIFA13cJ/rrrrrpbEn5UnanjPRZfZy1wvI8:bVXuzd6IF0czwNPDZfI8
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\finalizing.jpg MD5: 02f6bbe060f32e49e3caf2de8e60ec7f
SHA1: 4674875a4f264a947da6bf6f626b9bd50325d034
SHA256: 20072ae2e122a6407dac4771544158d7bcecebf98404c22001b0e69f79c8580d
SSDeep: 48:HJnkSA0qNcJaaNITrMsqptTT79UMRrgJf8:HJnLVJaaGP5gtTVRgV8
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\info MD5: 554ff4c199562515d758c9abff5c2943
SHA1: 9e3bab3a975e638ead9e03731ae82fa1dbcd178c
SHA256: 9ae4a96bf2a349667e844acc1e2ac4f89361a6182268438f4d063df3a6fc47bc
SSDeep: 12:hEipI3VFpSyZ9I7imddddGDxxOxzma3ZmRgRtqVtipMLXwHqfM:hEigFpTz1xA6aJmRgwi6LgHcM
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\infoex.ico MD5: fd535e63f539eacb3f11d03b52b39a80
SHA1: a7f8c942e5672f2972c82210a38cc8861435f643
SHA256: 0086bc01150989f553a0a4ae0e14926c6e247cedda312e1f946ae35d575742ab
SSDeep: 192:0DT6aNn0CgAevbxezcSptuGH0BJ1cBYehJjbQypQ6X8rdb:/aNn0DAoN4c8HH031/QQ6XWZ
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\installing.jpg MD5: a98e2f7d5dc055ad4b4b6d92126d9190
SHA1: c2db85dcf7bf991e8bba0d39f952748dc98d41d6
SHA256: 65751616edb29437b01cd352b8651835ca585942a78adaac589f9f8c16039470
SSDeep: 24:jjJdY5R9YB5j/vo9s5RVkB6+ANYPV/RBcmSSntyT7tlA+YkXHHWYC/ZxWtXPFU1/:HJZjYEVkM+mYNRSmdncq90nUxWtXP200
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\lzmaextractor.dll MD5: 6a06d2405b81845330ae5c97b31d2663
SHA1: 75293a2c50528d86197976a1a74beb97a6202a65
SHA256: 6e0f72297a10eb38593faf6d52ce964c45873f2e2f4fdcf468fb592fb763851c
SSDeep: 192:r2FFw7VkzjNB1CMGVfozI2az9FU8zQyMrj6Pou7+wta43UN5:iO0j1CMGVfqIrrVMCguS4kj
ImpHash: 8a050fdcf8a6aa995f44dcdc1218b881 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\minbackground.jpg MD5: ec713b6158a057b7825274ae4e1cf183
SHA1: c8178cf6a46e14e82f4ebde407ff04ff931ca7dd
SHA256: 04942fb23c0fb15aa732881c411fd2b4f44a621267e2c1de182c39b014a87211
SSDeep: 192:W+AZfX5qVtV50vrOalV2vNWeXx8W/WsyPSSj8F+paC:W+A9X5A50iOV11qWsjPF+3
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\New MD5: c23cbf002d82192481b61ed7ec0890f4
SHA1: dd373901c73760ca36907ff04691f5504ff00abe
SHA256: 4f92e804a11453382ebff7fb0958879bae88fe3366306911dec9d811cd306eed
SSDeep: 3:PFErXllvlNl/AXll/lFl/Ft/HtAiotuZt/nZllBe+llBe+llBe+llBe+llBe+lll:k9ij1BjjjjjTtXGuwtOZBl
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\preparing.jpg MD5: d20270537ae700b03b988fc7471c820e
SHA1: 3b68b1be0a7d30df6ed8952c34794e90102b77df
SHA256: a8c29d7365a7ed4191b20d08be6274215f5f12be420e826852205c4f3755dbb4
SSDeep: 24:jjJdY5FXXI4jKnP7lf0xdIOZNfHmLSOp+7KgzjTl779R438M969t5Wbgnb4JZKP:HJsXY3P7yxJumcajTtpRFMg99nb4jKP
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\Prereq.dll MD5: b831569a917e0e543fccdf3672c7a10e
SHA1: df1e395dc41ab8d1ae9401e4d2181fdfa24623cd
SHA256: e2d7938bea1174359bac78d610678ba586db58fab70901ba287623560a9a9fe6
SSDeep: 6144:InoEknCuM9Rhyj06nqdsbEsE/Cl3xo4hTUR/b8+:IoEknjM9Ren1bEsEKl3xonRD8+
ImpHash: 0d2f797c578e26f48b3ba36fd41fd0d1 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\removeex.ico MD5: aa0a5f0280c98006741b6cb56c3a360e
SHA1: ac820bbec6d08545a4a4818df9eb09b521bf2e40
SHA256: 2ac61cea48ccdb1751cb6b93ba90267508ed6ac900b2e2ac6ead172c9b8958f2
SSDeep: 192:4cYE5eZRboMB6f5iR59urg5N+qdrzt2eYi:4cAshf5quryvdPwzi
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\repairex.ico MD5: 4dba3637f5fceaadd2184bd8a0f0fb95
SHA1: a858418c32f5d45f15ab01cafc652b507de2a42b
SHA256: c1ad1e78a112974326b44f75fe302723a4fc8ac1ccd96c9887403f6ddf8e607d
SSDeep: 192:+q2qe82nprAWkcWFW57oVht/k2VxomK0qHTk4TdrofvMxnVRYAn4vf:ej84ArgojFTVxoz0qHNTdr+vKVRYAIf
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\tabback MD5: 4c3dda35e23d44e273d82f7f4c38470a
SHA1: b62bc59f3eed29d3509c7908da72041bd9495178
SHA256: e728f79439e07df1afbcf03e8788fa0b8b08cf459db31fc8568bc511bf799537
SSDeep: 24:kUGGGGGGGGjg/QUVdLbCKKKKKKWqqqqqqr:kGUVdnCKKKKKKWqqqqqqr
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\typicalex.ico MD5: eb3f9054bb5f95ed6b10ec4e16a026be
SHA1: 35760271a03029996bda26d5d596cfcc465e3ea9
SHA256: e330fa8030aa0465b02880133addba0a8c6011b511f6968b413bf45516f7275e
SSDeep: 192:entnoFoTahmFxRYq7mE25b6K0FHQHVd4oXb2zwNf3i4ij:enWuPFxt785T0FHQHgo2wNf3oj
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\Up MD5: 83730ac00391fb0f02f56fe2e4207a10
SHA1: 139fed8f0216132450e66bda0fbbdc2a5bd333af
SHA256: 573e3260eed63604f24f6f10ce5294e25e22fda9e5bfd9010134de6e684bab98
SSDeep: 3:PFErXllvlNl/AXll/lFl/Ft/HtAiotuZt/nreBB+eKemhlRhmeemfB+ll5evZ/Xy:k9ij1KBBhK9jwmfBuiKaq5n
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\white.jpg MD5: 57d130ddf327fcc5da636a6ab4d7c112
SHA1: d674f332d4f79c70d4a97bfd9e504a8f3a2c26b6
SHA256: 990eab9faaae9f78201ef00a72f7b59773eed2b2fc9ec72250c67f376ee0500f
SSDeep: 3:nSullBbsRllAqp/y4FKKn5bbeWfa5QpUolHmBkDt0+EtZtE//Wmst18n:3llxqQ8AfQRGSDt0RZty/Wmsw
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\AI_EXTUI_BIN_2564\whitesmall.jpg MD5: 4429f170056663efd1486395e8eb0af6
SHA1: ae9b01a44c8ee5ae7146f0523e512ee32dc284ad
SHA256: ffe2980d90152ef603555a735b7cba1917c99bb67061b44d6ac6f12e6384bdd9
SSDeep: 3:nSullBbsRllAqp/y4FKKn5bbeWfa5QpUolG5PkDt0+EtZtE//WmstN8n:3llxqQ8AfQRG5cDt0RZty/WmsY
ImpHash: None 		Access, Write Created File
C:\Users\EEBsYm5\AppData\Local\Temp\installer.madExcept\ - Access
C:\Users\EEBsYm5\AppData\Local\Temp\installer.madExcept\. - Access
C:\Users\EEBsYm5\AppData\Local\Temp\killself.bat - Access, Write
C:\Users\EEBsYm5\AppData\Local\Temp\rutserv.madExcept\ - Access
C:\Users\EEBsYm5\AppData\Local\Temp\rutserv.madExcept\. - Access
\\?\C:\Users\EEBsYm5\AppData\Roaming - Access
\\?\C:\Users\EEBsYm5\AppData\Roaming\Adobe - Access
C:\Users\EEBsYm5\AppData\Roaming\Adobe\Adobe Reader - Access
\\?\C:\Users\EEBsYm5\AppData\Roaming\Adobe\Adobe Reader 12.0.1 - Access
\\?\C:\Users\EEBsYm5\AppData\Roaming\Adobe\Adobe Reader 12.0.1\install - Access
\\?\C:\Users\EEBsYm5\AppData\Roaming\Adobe\Adobe Reader 12.0.1\install\setup.msi MD5: faefe083c40bc8a079c200424386f000
SHA1: 3ac616ee5902e23ead8ae3b252080a3f2097135e
SHA256: fe01fe7743184d35430f0f1439e826bb6e6e40c74401da017e3db3dd8166a6ec
SSDeep: 24576:P8FsyPEkYoSsnl3xonRD8PuLmmLM8PjWJ+SkJO:P86voSsl3xonRD8PuLjLhPSJ+SkJ
ImpHash: None 		Access, Read, Write Created File
C:\Users\EEBsYm5\AppData\Roaming\Adobe\Adobe Reader\prerequisites - Access
C:\Users\EEBsYm5\AppData\Roaming\Adobe\Adobe Reader\prerequisites\RequiredApplication - Access
C:\Users\EEBsYm5\AppData\Roaming\Adobe\Adobe Reader\prerequisites\RequiredApplication\setup.exe MD5: fe81caf55bd98d3b8d53bdd38f214dcb
SHA1: 0defd3e408dee73b55e8d05ac2df12b86c8d7302
SHA256: 914d529465cdc3b7598bd4c0457583f2e779180fd206f85867f9abd7f8cd739b
SSDeep: 196608:itDW2c3gwhxOn0UM0Uyqn6Stt6MNfW9BKzFhBgDwdlzOoxJOh1odBPg14Kq4QKxY:I/ln0Dyqntt6MJsKzFhBDlzxJ+1o36Ij
ImpHash: c9adc83b45e363b21cd6b11b5da0501f 		Access, Read Created File
C:\Users\EEBsYm5\AppData\Roaming\Adobe\Adobe Reader\prerequisites\RequiredApplication\setup.exe.part MD5: fe81caf55bd98d3b8d53bdd38f214dcb
SHA1: 0defd3e408dee73b55e8d05ac2df12b86c8d7302
SHA256: 914d529465cdc3b7598bd4c0457583f2e779180fd206f85867f9abd7f8cd739b
SSDeep: 196608:itDW2c3gwhxOn0UM0Uyqn6Stt6MNfW9BKzFhBgDwdlzOoxJOh1odBPg14Kq4QKxY:I/ln0Dyqntt6MJsKzFhBDlzxJ+1o36Ij
ImpHash: c9adc83b45e363b21cd6b11b5da0501f 		Access, Write Created File
C:\Users\EEBsYm5\Desktop\adobereader_dcupd_en_cra_install.exe MD5: eda8e4f2df81e0ba5b88d73de9779205
SHA1: 485163ba7eb1ba74030c9be2222a183643595c36
SHA256: e93cf7c4f464ff015bda21fed805744beaf2d631ccd7cc81eb8a434a5bc73775
SSDeep: 49152:hgH1mzGSx+/QYSP73v8QRILjWyRP86voSsl3xonRD8PuLjLhPSJ+SkJA:hgH1sGSxiQYSP7U1vds11WHLhPD9K
ImpHash: None 		Access, Read Sample File
C:\Windows\ - Access
C:\Windows\Installer - Access
C:\Windows\Installer\ - Access
C:\Windows\Installer\$PatchCache$\Managed - Access
C:\Windows\Installer\$PatchCache$\Managed\00004109450090400000000000F01FEC\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\Managed\000041094B0090400000000000F01FEC\CacheSize.txt - Access, Read
C:\Windows\Installer\$PatchCache$\Managed\00004109510090400000000000F01FEC\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\Managed\00004109511090400000000000F01FEC\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\Managed\00004109810090400000000000F01FEC\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\Managed\00004109B10090400000000000F01FEC\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\Managed\00004109C20090400000000000F01FEC\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\Managed\00004109E60090400000000000F01FEC\CacheSize.txt - Access, Read
C:\Windows\Installer\$PatchCache$\Managed\00004109F10090400000000000F01FEC\CacheSize.txt - Access, Read
C:\Windows\Installer\$PatchCache$\Managed\00004109F100A0C00000000000F01FEC\CacheSize.txt - Access, Read
C:\Windows\Installer\$PatchCache$\Managed\00004109F100C0400000000000F01FEC\CacheSize.txt - Access, Read
C:\Windows\Installer\$PatchCache$\Managed\00004119110000000000000000F01FEC\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\Managed\00004119750000000000000000F01FEC\CacheSize.txt - Access, Read
C:\Windows\Installer\$PatchCache$\Managed\00004119B30000000000000000F01FEC\CacheSize.txt - Access, Read
C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\Managed\4A78C4EDFD652F04FBB339415F8F16B0 - Access
C:\Windows\Installer\$PatchCache$\Managed\B382549EC85704A48B1501660D4EE98A - Access
C:\Windows\Installer\$PatchCache$\Managed\c1c4f01781cc94c4c8fb1542c0981a2a\CacheSize.txt - Access
C:\Windows\Installer\$PatchCache$\UnManaged - Access
C:\Windows\Installer\30de4.msi MD5: faefe083c40bc8a079c200424386f000
SHA1: 3ac616ee5902e23ead8ae3b252080a3f2097135e
SHA256: fe01fe7743184d35430f0f1439e826bb6e6e40c74401da017e3db3dd8166a6ec
SSDeep: 24576:P8FsyPEkYoSsnl3xonRD8PuLmmLM8PjWJ+SkJO:P86voSsl3xonRD8PuLjLhPSJ+SkJ
ImpHash: None 		Access, Write Created File
C:\Windows\Installer\30de5.ipi MD5: 84abf78f611bc447e180ee4d9f2b5214
SHA1: 7fd8a7c777c71f2a6058f9ea56d96737cc9138db
SHA256: fe41866248a23b66bf1731eaa5b0af2d6e0f69fbb5dc0020652e6b943e3e8e4a
SSDeep: 48:y1kwGvcxzvuhUbeToEzSkdzfdzfIgUIg8UvZF7ieTxpDI8TSkdzYdzyK+Jo7:yqwG+6hge/z/IDIMMe3I8T017
ImpHash: None 		Access Created File
C:\Windows\Installer\30de7.msi - Access
C:\Windows\Installer\30de8.msi - Access, Write
C:\Windows\Installer\30dea.ipi MD5: d802ddd04a850b75448fd86eb3d729ba
SHA1: 5a4da634628525a22eb0fcd1f2502bcbf02c810a
SHA256: 4962ce82cf9563a9ff984c00e8058f16acab7faf9a35be1b1ca6672328e70fa9
SSDeep: 96:1URykWhDeto5aMTXkXiXxfrLtySjqlCMTXkXiXxfrL6m:18aC25Xfjqls
ImpHash: None 		Access Created File
C:\Windows\Installer\30dec.msi - Access
C:\Windows\Installer\MSI14E6.tmp MD5: 6a9c36332255fca66c688c75aa68e1de
SHA1: 2a03e2a5e6a8d9e2b0cfb4e2cc1923d9c08578c1
SHA256: 7b7ebada5da99a20c44eaf77e6d673985da42d9b7cb4f5e4235b7579581ae170
SSDeep: 1536:pysRX1fpScTNumPTXhMw+m3/3Uw5VJdK5KviuWyVstdEpH:jXtpSchuqP3Z5VJZVDp
ImpHash: 231c071429367723c9ac790e87dcf614 		Access, Write Created File
C:\Windows\Installer\MSI1832.tmp MD5: b831569a917e0e543fccdf3672c7a10e
SHA1: df1e395dc41ab8d1ae9401e4d2181fdfa24623cd
SHA256: e2d7938bea1174359bac78d610678ba586db58fab70901ba287623560a9a9fe6
SSDeep: 6144:InoEknCuM9Rhyj06nqdsbEsE/Cl3xo4hTUR/b8+:IoEknjM9Ren1bEsEKl3xonRD8+
ImpHash: 0d2f797c578e26f48b3ba36fd41fd0d1 		Access, Write Created File
C:\Windows\Installer\MSI1E1C.tmp - Access, Read
C:\Windows\Installer\MSI1F07.tmp MD5: b831569a917e0e543fccdf3672c7a10e
SHA1: df1e395dc41ab8d1ae9401e4d2181fdfa24623cd
SHA256: e2d7938bea1174359bac78d610678ba586db58fab70901ba287623560a9a9fe6
SSDeep: 6144:InoEknCuM9Rhyj06nqdsbEsE/Cl3xo4hTUR/b8+:IoEknjM9Ren1bEsEKl3xonRD8+
ImpHash: 0d2f797c578e26f48b3ba36fd41fd0d1 		Access, Write Created File
C:\Windows\Installer\MSI27DF.tmp - Access
C:\Windows\Installer\MSIA089.tmp MD5: 52185b209cfdb02d88b4a40a4bdf0911
SHA1: aa35fedfeefbee93bcca5a30feed8d240e2d1c95
SHA256: 756543551f27e9450dcf0ffdd10cd44af6fd0e8dbca037dee5b575683d5a9492
SSDeep: 1536:Ae5evr0fQtkUlPeG+U+n4PtjrqzN/cWJQaqYAJmmD+e7cKsWjcdlsKc8rlq6W9Eq:AievrFt0KyqmDqFJr+egmKc8rANw+
ImpHash: d9c1c20b1ae3223eb5b97c09d7a0a4d0 		Access, Write Created File
C:\Windows\Installer\MSIA423.tmp - Access, Read, Write
C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\ARPPRODUCTICON.exe - Access
C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_settings_E3BFC76BE38F4CF79D2ED7163B7DECEE.exe - Access
C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_start_85DB64512C79429FA70AC6C0611579DD.exe - Access
C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\en_server_stop_B603677802D142C98E7A415B72132E14.exe - Access
C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\UNINST_Uninstall_R_3B1E3C8B7D0945898DA82CEEED02F0C7.exe - Access
C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.dll - Access
C:\Windows\system32 - Access
C:\Windows\system32\MsiExec.exe - Access
C:\Windows\TEMP\rutserv.madExcept\.. - Access
C:\Windows\TEMP\rutserv.madExcept\ - Access
C:\Windows\TEMP\rutserv.madExcept\. - Access
System Paging File - Read
Registry (641)
»
Registry Key Name Operations
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Control Panel\Desktop Access
HKEY_CURRENT_USER\Control Panel\Desktop\ScreenSaverIsSecure Read
HKEY_CURRENT_USER\Environment Access
HKEY_CURRENT_USER\Environment\TEMP Read
HKEY_CURRENT_USER\Environment\TMP Read
HKEY_CURRENT_USER\InterbootContext Access, Delete
HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Access
HKEY_CURRENT_USER\Software\Borland\Locales Access
HKEY_CURRENT_USER\Software\CodeGear\Locales Access
HKEY_CURRENT_USER\Software\Embarcadero\Locales Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Access
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\InetStp Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\MS Shell Dlg 2 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallDate Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Central Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Central Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Central Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Central Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Central Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Central Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Central Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\2007 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\2008 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\FirstEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\LastEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Afghanistan Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Afghanistan Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Afghanistan Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Afghanistan Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Afghanistan Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Afghanistan Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Afghanistan Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Dynamic DST\2006 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Dynamic DST\2007 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Dynamic DST\FirstEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Dynamic DST\LastEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Alaskan Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arab Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arab Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arab Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arab Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arab Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arab Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arab Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabian Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabian Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabian Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabian Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabian Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabian Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabian Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Dynamic DST\2006 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Dynamic DST\2007 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Dynamic DST\2008 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Dynamic DST\FirstEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Dynamic DST\LastEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Arabic Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dynamic DST\2006 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dynamic DST\2007 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dynamic DST\2008 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dynamic DST\2009 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dynamic DST\2010 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dynamic DST\FirstEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Dynamic DST\LastEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Argentina Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Dynamic DST\2006 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Dynamic DST\2007 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Dynamic DST\FirstEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Dynamic DST\LastEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Atlantic Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azerbaijan Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azerbaijan Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azerbaijan Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azerbaijan Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azerbaijan Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azerbaijan Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azerbaijan Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azores Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azores Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azores Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azores Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azores Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azores Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Azores Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Dynamic DST\2008 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Dynamic DST\2009 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Dynamic DST\2010 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Dynamic DST\FirstEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Dynamic DST\LastEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Bangladesh Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\Index Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\MapID Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Cape Verde Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Cape Verde Standard Time\Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Cape Verde Standard Time\Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Cape Verde Standard Time\Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\DisplayIcon Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\DisplayName Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\DisplayVersion Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\EstimatedSize Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\InstallDate Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\InstallLocation Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\InstallSource Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\Language Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\NoModify Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\NoRepair Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\Publisher Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\UninstallString Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\VersionMajor Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Flash Player 2.5.1.1\VersionMinor Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\DisplayIcon Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\DisplayName Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\DisplayVersion Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\EstimatedSize Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\InstallDate Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\InstallLocation Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\InstallSource Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\Language Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\NoModify Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\NoRepair Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\Publisher Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\UninstallString Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\VersionMajor Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\H&S Tech 4.0.0.1\VersionMinor Write
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RManService Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations Read
HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities Host Installer Access
HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities Host Installer\Options Read, Write
HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities Host Installer\Password Read, Write
HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities Host Installer\SyncUserAccess Read, Write
HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities Host Installer\UserAccess Read, Write
HKEY_LOCAL_MACHINE\SYSTEM\Remote Utilities Host Installer\notification Write
HKEY_LOCAL_MACHINE\Software\Adobe\Adobe Reader Access
HKEY_LOCAL_MACHINE\Software\Adobe\Adobe Reader\Path Read, Write
HKEY_LOCAL_MACHINE\Software\Adobe\Adobe Reader\Version Write
HKEY_LOCAL_MACHINE\Software\Caphyon\Advanced Installer\LZMA\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\12.0.1 Access
HKEY_LOCAL_MACHINE\Software\Caphyon\Advanced Installer\LZMA\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\12.0.1\AI_ExePath Write
HKEY_LOCAL_MACHINE\Software\Caphyon\Advanced Installer\Prereqs\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\12.0.1 Access
HKEY_LOCAL_MACHINE\Software\Caphyon\Advanced Installer\Prereqs\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\12.0.1\RequiredApplication Write
HKEY_LOCAL_MACHINE\Software\Classes Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\4A78C4EDFD652F04FBB339415F8F16B0 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\4A78C4EDFD652F04FBB339415F8F16B0\MainFeature Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\4A78C4EDFD652F04FBB339415F8F16B0\RequiredApplication Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\B382549EC85704A48B1501660D4EE98A Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Features\B382549EC85704A48B1501660D4EE98A\RMS Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\000041091A0090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\000041091A0090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\000041091A0090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109440090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109440090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109440090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109450090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109450090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109450090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\000041094B0090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\000041094B0090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\000041094B0090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109510090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109510090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109510090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109511090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109511090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109511090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109610090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109610090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109610090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109711090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109711090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109711090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109810090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109810090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109810090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109910090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109910090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109910090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109A10090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109A10090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109A10090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109AB0090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109AB0090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109AB0090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109B10090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109B10090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109B10090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109C20090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109C20090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109C20090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109E60090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109E60090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109E60090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F10090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F10090400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F10090400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F100A0C00000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F100A0C00000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F100A0C00000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F100C0400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F100C0400000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004109F100C0400000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119110000000000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119110000000000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119110000000000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119750000000000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119750000000000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119750000000000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119B30000000000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119B30000000000000000F01FEC\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\00004119B30000000000000000F01FEC\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\2246038675C7F37388062DC64EABA251 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\2246038675C7F37388062DC64EABA251\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\2246038675C7F37388062DC64EABA251\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4755C4440EB6E323B9DD29F2C6C3A440 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4755C4440EB6E323B9DD29F2C6C3A440\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4755C4440EB6E323B9DD29F2C6C3A440\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\AdvertiseFlags Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\Assignment Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\AuthorizedLUAApp Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\Clients Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\DeploymentFlags Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstanceType Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\Language Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\PackageCode Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\ProductName Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\SourceList Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\SourceList\LastUsedSource Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\SourceList\Net Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\SourceList\Net\1 Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\SourceList\PackageName Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0\Version Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4EA42A62D9304AC4784BF238120754FF Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4EA42A62D9304AC4784BF238120754FF\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\4EA42A62D9304AC4784BF238120754FF\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA7FFFFB744AA0000000010 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA7FFFFB744AA0000000010\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\68AB67CA7DA7FFFFB744AA0000000010\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\6E815EB96CCE9A53884E7857C57002F0\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\838AE285991981530AC5BD9064F286CE Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\838AE285991981530AC5BD9064F286CE\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\838AE285991981530AC5BD9064F286CE\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\AdvertiseFlags Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Assignment Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\AuthorizedLUAApp Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Clients Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\DeploymentFlags Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\InstanceType Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Language Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\PackageCode Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\ProductIcon Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\ProductName Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\LastUsedSource Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media\1 Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Media\DiskPrompt Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Net Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\Net\1 Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\SourceList\PackageName Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\B382549EC85704A48B1501660D4EE98A\Version Read, Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\C025571B2A687A53689168CD7369889B Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\C025571B2A687A53689168CD7369889B\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\C025571B2A687A53689168CD7369889B\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\F60730A4A66673047777F5728467D401 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\F60730A4A66673047777F5728467D401\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\F60730A4A66673047777F5728467D401\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\InstanceType Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a\PackageCode Read
HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\1FB7268953FC9EF428A2FDDA944DDFE5 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\1FB7268953FC9EF428A2FDDA944DDFE5\4A78C4EDFD652F04FBB339415F8F16B0 Write
HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 Access
HKEY_LOCAL_MACHINE\Software\Classes\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\CodeGear\Locales Access
HKEY_LOCAL_MACHINE\Software\Embarcadero\Locales Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Version Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\RegisteredOwner Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Config.Msi\ Read, Write, Delete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Remote Utilities - Host\ Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Remote Utilities - Host\Monitor\ Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Remote Utilities - Host\Monitor\x64\ Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Remote Utilities - Host\Monitor\x86\ Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Remote Utilities - Host\Printer\ Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Remote Utilities - Host\Printer\x64\ Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Remote Utilities - Host\Printer\x86\ Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Windows\Installer\{E945283B-758C-4A40-B851-1066D0E49EA8}\ Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\InProgress Access, Read, Write, Delete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\000041091A0090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109440090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109450090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\000041094B0090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109510090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109511090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109610090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109711090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109810090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109910090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109A10090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109AB0090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109B10090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109C20090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109E60090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109F10090400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109F100A0C00000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004109F100C0400000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004119110000000000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004119750000000000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\00004119B30000000000000000F01FEC Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\2246038675C7F37388062DC64EABA251 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\4755C4440EB6E323B9DD29F2C6C3A440 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\4EA42A62D9304AC4784BF238120754FF Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\68AB67CA7DA7FFFFB744AA0000000010 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\6E815EB96CCE9A53884E7857C57002F0 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\838AE285991981530AC5BD9064F286CE Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\B382549EC85704A48B1501660D4EE98A Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\C025571B2A687A53689168CD7369889B Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\F60730A4A66673047777F5728467D401 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Managed\S-1-5-21-3785418085-2572485238-895829336-1000\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback Access, Delete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts Access, Delete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts\C:\Config.Msi\30de6.rbs Read, Write, Delete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts\C:\Config.Msi\30de6.rbsLow Read, Write, Delete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts\C:\Config.Msi\30deb.rbs Read, Write, Delete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts\C:\Config.Msi\30deb.rbsLow Read, Write, Delete
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts\ScriptsDisabled Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\1FB7268953FC9EF428A2FDDA944DDFE5 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\1FB7268953FC9EF428A2FDDA944DDFE5\4A78C4EDFD652F04FBB339415F8F16B0 Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\029705A57F1E1AD4F97654DAD0C441E3 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\029705A57F1E1AD4F97654DAD0C441E3\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3606D44453621DC46BC17BA1F9DA739D Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3606D44453621DC46BC17BA1F9DA739D\4A78C4EDFD652F04FBB339415F8F16B0 Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\481CA97E83DA62B4980D577BEC1AF92A Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\481CA97E83DA62B4980D577BEC1AF92A\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\490EF1B1D5DB88F45B337159197E181D Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\490EF1B1D5DB88F45B337159197E181D\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6364F69515D55F943B4B3F3C669ECD32 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6364F69515D55F943B4B3F3C669ECD32\00000000000000000000000000000000 Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6364F69515D55F943B4B3F3C669ECD32\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EDC4423414699340B5D245426472701 Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6EDC4423414699340B5D245426472701\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DA75A08B421DA442A929C56444AD01F Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DA75A08B421DA442A929C56444AD01F\4A78C4EDFD652F04FBB339415F8F16B0 Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B296F791ACC797D4585ADE4002D2800D Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B296F791ACC797D4585ADE4002D2800D\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B99DCB78D08AE7046A3A76A15014354B Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B99DCB78D08AE7046A3A76A15014354B\4A78C4EDFD652F04FBB339415F8F16B0 Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E081FFDBED9215946AE89615F366707B Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E081FFDBED9215946AE89615F366707B\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E45BAE6295648E74689FC47BF4E730EB Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E45BAE6295648E74689FC47BF4E730EB\B382549EC85704A48B1501660D4EE98A Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\Features Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\Features\MainFeature Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\Features\RequiredApplication Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\AuthorizedCDFPrefix Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\Comments Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\Contact Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\DisplayName Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\DisplayVersion Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\EstimatedSize Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\HelpLink Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\HelpTelephone Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\InstallDate Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\InstallLocation Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\InstallSource Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\Language Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\LocalPackage Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\ModifyPath Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\Publisher Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\Readme Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\Size Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\URLInfoAbout Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\URLUpdateInfo Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\UninstallString Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\Version Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\VersionMajor Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\VersionMinor Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\InstallProperties\WindowsInstaller Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\Patches Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\Patches\AllPatches Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4A78C4EDFD652F04FBB339415F8F16B0\Usage Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\Features Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\Features\RMS Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\AuthorizedCDFPrefix Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\Comments Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\Contact Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\DisplayName Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\DisplayVersion Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\EstimatedSize Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\HelpLink Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\HelpTelephone Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\InstallDate Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\InstallLocation Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\InstallSource Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\Language Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\LocalPackage Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\ModifyPath Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\NoModify Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\NoRepair Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\ProductID Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\Publisher Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\Readme Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\RegCompany Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\RegOwner Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\Size Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\URLInfoAbout Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\URLUpdateInfo Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\UninstallString Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\Version Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\VersionMajor Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\VersionMinor Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\InstallProperties\WindowsInstaller Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\Patches Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\Patches\AllPatches Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\B382549EC85704A48B1501660D4EE98A\Usage Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RegisteredOrganization Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RegisteredOwner Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B} Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\AuthorizedCDFPrefix Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\Comments Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\Contact Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\DisplayName Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\DisplayVersion Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\EstimatedSize Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\HelpLink Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\HelpTelephone Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\InstallDate Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\InstallLocation Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\InstallSource Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\Language Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\ModifyPath Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\Publisher Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\Readme Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\Size Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\URLInfoAbout Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\URLUpdateInfo Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\UninstallString Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\Version Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\VersionMajor Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\VersionMinor Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{DE4C87A4-56DF-40F2-BF3B-9314F5F8610B}\WindowsInstaller Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8} Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\AuthorizedCDFPrefix Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\Comments Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\Contact Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\DisplayName Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\DisplayVersion Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\EstimatedSize Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\HelpLink Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\HelpTelephone Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\InstallDate Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\InstallLocation Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\InstallSource Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\Language Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\ModifyPath Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\NoModify Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\NoRepair Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\Publisher Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\Readme Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\Size Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\URLInfoAbout Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\URLUpdateInfo Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\UninstallString Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\Version Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\VersionMajor Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\VersionMinor Read, Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{E945283B-758C-4A40-B851-1066D0E49EA8}\WindowsInstaller Read, Write
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\ComSpec Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\FP_NO_HOST_CHECK Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\NUMBER_OF_PROCESSORS Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\OS Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PATHEXT Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_IDENTIFIER Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_LEVEL Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_REVISION Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\PSModulePath Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\Path Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\TEMP Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\TMP Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\USERNAME Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment\windir Read
HKEY_USERS\S-1-5-18\Software\Policies\Microsoft\Windows\Installer Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\000041091A0090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109440090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109450090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\000041094B0090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109510090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109511090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109610090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109711090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109810090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109910090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109A10090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109AB0090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109B10090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109C20090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109E60090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109F10090400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109F100A0C00000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004109F100C0400000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004119110000000000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004119750000000000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\00004119B30000000000000000F01FEC Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\1D5E3C0FEDA1E123187686FED06E995A Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\21EE4A31AE32173319EEFE3BD6FDFFE3 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\2246038675C7F37388062DC64EABA251 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\22BEFC8F7E2A1793E9ADB411DEFE1C58 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\4755C4440EB6E323B9DD29F2C6C3A440 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\4A78C4EDFD652F04FBB339415F8F16B0 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\4EA42A62D9304AC4784BF238120754FF Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\68AB67CA7DA7FFFFB744AA0000000010 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\6E815EB96CCE9A53884E7857C57002F0 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\838AE285991981530AC5BD9064F286CE Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\B382549EC85704A48B1501660D4EE98A Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\C025571B2A687A53689168CD7369889B Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\DC8A59DBF9D1DA5389A1E3975220E6BB Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\F60730A4A66673047777F5728467D401 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\Products\c1c4f01781cc94c4c8fb1542c0981a2a Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Microsoft\Installer\UpgradeCodes\509B38EF4554FFD4794F292971C81B17 Access
HKEY_USERS\S-1-5-21-3785418085-2572485238-895829336-1000\Software\Policies\Microsoft\Windows\Installer Access
Mutex (7)
»
Mutex Name Operations
Global\_MSIExecute Access
HookTThread$7ec Access
madExceptSettingsMtx$504 Access, Delete
madExceptSettingsMtx$7ec Access, Delete
madExceptSettingsMtx$f20 Access, Delete
madExceptSettingsMtx$fa8 Access, Delete
madExceptSettingsMtx$fc4 Access, Delete
Domain (1)
»
Domain Sources
adobemacromedia.com PCAP, Function Log
URL (2)
»
URL Operations Sources
HTTP://adobemacromedia.com/setup.exe GET Function Log
http://adobemacromedia.com/setup.exe GET PCAP
IP (1)
»
IP Protocols Sources
104.28.4.137 HTTP, TCP, UDP Function Log, PCAP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image