IOC Report
WIN_DCA_2.4.0.10611_sursvc_qh.msi

loading gif

Files

File Path
Type
Category
Malicious
WIN_DCA_2.4.0.10611_sursvc_qh.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Intel(R) Computing Improvement Program, Author: Intel Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Intel(R) Computing Improvement Program., Template: x64;1033, Revision Number: {A4F8A013-9572-4012-BCC5-F900FEB274A5}, Create Time/Date: Tue Sep 26 01:59:06 2023, Last Saved Time/Date: Tue Sep 26 01:59:06 2023, Number of Pages: 405, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
initial sample
C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.sys
PE32+ executable (native) x86-64, for MS Windows
dropped
malicious
C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.sys
PE32+ executable (native) x86-64, for MS Windows
dropped
malicious
C:\Config.Msi\4d7960.rbs
data
dropped
C:\Program Files\Intel\SUR\ICIP\Config.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\ICIP\SURV8_ICIP.log
CSV text
dropped
C:\Program Files\Intel\SUR\ICIP\SurConsent.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\AnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\AudioAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\BatteryAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\BoundnessEventsAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\BrowserHistoryAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\CSMEAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\CapiEtlAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Common.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Config.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\CrashLogAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DBAccessLayer.dll.config
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DSACoreInterop64.dll
PE32+ executable (DLL) (GUI) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DSADcaIntegration.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DevUseAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DisplayAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DisplayStateAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DriverDetection.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\DttEtlAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\EntityFramework.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\EventLogCollection.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\FPSAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\FgndBackgrndAppsAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\GenericSqlATLSupport.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\HWMetaTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\HWPowerStatsTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\HeartBeatAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\IntelFgndAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\LICENSE.txt
Unicode text, UTF-8 text, with very long lines (17652), with no line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\NetworkBandwidthAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\OSPerfCounterAnalyzerTasks.dll.config
XML 1.0 document, Unicode text, UTF-8 (with BOM) text
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\OSSystemAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\PhatAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\ProcessAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\SleepStudyAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\SurSvc.exe.config
XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.EF6.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\System.Data.SQLite.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\SystemPowerStateAnalyzerTask.dll.config
XML 1.0 document, Unicode text, UTF-8 (with BOM) text
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\SystemUsageByFgndAppAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\TextExtractorAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\IntelSoftwareAssetManagerService.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\ScheduleUpdates.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\VCRUNTIME140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ctypes.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_decimal.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_elementtree.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_hashlib.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_lzma.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_multiprocessing.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_queue.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_socket.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_ssl.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\_win32sysloader.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64\UpdateServiceProxy64.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\base_library.zip
Zip archive data, at least v2.0 to extract, compression method=store
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libcrypto-1_1.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libffi-8.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\libssl-1_1.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\perfmon.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pyexpat.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\python311.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pythoncom311.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\pywintypes311.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\select.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\servicemanager.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\shell_executor.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\unicodedata.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32api.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32event.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32evtlog.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32file.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32inet.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32pipe.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32process.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32profile.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32security.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32service.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32trace.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\win32ts.pyd
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\cacert.pem
Unicode text, UTF-8 text, with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config.ini
Generic INItialization configuration [ScheduledUpdate]
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\config_api.ini
ASCII text, with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\licenses.txt
Unicode text, UTF-8 text, with very long lines (2404), with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\logging_config.json
JSON data
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\UserWaitTimeAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\WifiAnalyzerTask.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\analyzer.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\apptable.csv
CSV text
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\lookup.zip
Zip archive data, at least v2.0 to extract, compression method=deflate
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\policy.json
JSON data
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\SQLite.Interop.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.cat
data
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\bertreader.inf
Windows setup INFormation
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_extractor.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\crashlog_options.txt
ASCII text
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\devices_use_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_daq.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_lib_security.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_svc.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv_thread_monitor.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\etw_options_config.txt
ASCII text
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\installer.bat
DOS batch file, ASCII text, with very long lines (1006), with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_acpi_battery_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_audio_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_crashlog_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_csme_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_desktop_mapper_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_display_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_etw_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_foreground_window_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_fps_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_heartbeat_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_hw_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_modeler.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_os_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_phat_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_process_watcher_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_sur_sysprep.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_system_power_state_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_user_waiting_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\intel_wifi_input.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\libcrypto-3-x64.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\pl_agent_lib.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\process_input_options.txt
ASCII text, with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\productivity_link_helper.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.cat
data
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\semav6msr64.inf
Windows setup INFormation
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\sql_logger.dll
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\sqlite3.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_eqs.txt
ASCII text, with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_hw_config.txt
ASCII text, with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\sur_os_counters.txt
ASCII text, with CRLF line terminators
dropped
C:\Program Files\Intel\SUR\QUEENCREEK\x64\task.exe
PE32+ executable (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\concrt140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\msvcp140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\msvcp140_atomic_wait.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\msvcp140_codecvt_ids.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\vccorlib140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\vcruntime140.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\$PatchCache$\Managed\8E3DA366D79E95546AF142EB3F838F95\2.4.10611\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3
PE32+ executable (DLL) (console) x86-64, for MS Windows
dropped
C:\Windows\Installer\4d795f.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Intel(R) Computing Improvement Program, Author: Intel Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Intel(R) Computing Improvement Program., Template: x64;1033, Revision Number: {A4F8A013-9572-4012-BCC5-F900FEB274A5}, Create Time/Date: Tue Sep 26 01:59:06 2023, Last Saved Time/Date: Tue Sep 26 01:59:06 2023, Number of Pages: 405, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
dropped
C:\Windows\Installer\MSI7D47.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI8027.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI8047.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI8365.tmp
data
dropped
C:\Windows\Installer\MSI84AE.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI850D.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Windows\Installer\MSI8A9C.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI8ACB.tmp
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\Windows\Installer\MSI8BB7.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI8C73.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI8D11.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI8E1B.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI8EB8.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI9EE6.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
modified
C:\Windows\Installer\SourceHash{663AD3E8-E97D-4559-A61F-24BEF338F859}
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Installer\inprogressinstallinfo.ipi
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Windows\Temp\~DF48B522A12B123A6A.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DF8661D37B3A8C61A2.TMP
data
dropped
C:\Windows\Temp\~DFBAF38C00F5CD249E.TMP
data
dropped
C:\Windows\Temp\~DFDB649F098ED07EEC.TMP
data
dropped
There are 169 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\WIN_DCA_2.4.0.10611_sursvc_qh.msi"
malicious
C:\Windows\System32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
malicious
C:\Windows\System32\msiexec.exe
C:\Windows\System32\MsiExec.exe -Embedding E7F40F8F2F38BFEEC7BA0DB05323DCA9
malicious
C:\Windows\SysWOW64\msiexec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 78F6467A912F7101ECAA8FAC8EA46C39
C:\Windows\SysWOW64\msiexec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 8A6FC679183817C2D9AAB98F3D254284 E Global\MSI0000
C:\Windows\System32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cd "C:\Program Files\Intel\SUR\QUEENCREEK\" && if exist SurSvc.exe (start /b /wait /d "C:\Program Files\Intel\SUR\QUEENCREEK\" SurSvc.exe /uninstall)
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
"C:\Windows\system32\cmd.exe" /c if exist "%PROGRAMDATA%\\Intel\\SharedData\\SDID" (del /f "%PROGRAMDATA%\\Intel\\SharedData\\SDID")
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
"CMD" /C RMDIR /S /Q "C:\Program Files\Intel\SUR\QUEENCREEK\Updater\" && RMDIR /S /Q "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\icacls.exe
"C:\Windows\system32\icacls.exe" "C:\Program Files\Intel\SUR\QUEENCREEK\x64\esrv.exe" /inheritance:r /grant:r SYSTEM:F Administrators:R Users:R
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Program Files\Intel\SUR\ICIP\SurConsent.exe
"C:\Program Files\Intel\SUR\ICIP\SurConsent.exe" -install
There are 4 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://www.intel.co.jp/content/www/jp/ja/privacy/in
unknown
https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html
unknown
http://www.fontbureau.com/designersG
unknown
https://intel.fr/privacy.
unknown
https://github.com/jquery/jquery
unknown
https://www.intel.com
unknown
https://www.intel.com2
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://www.intel.com.br/content/www/br/pt/support/topics/idsa-cip.html
unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
unknown
http://ocsp.sectigo.com0
unknown
http://www.fontbureau.com/designers?
unknown
https://www.intel.eu/content/www/eu/en/privacy/intel-privacy-notice.html
unknown
https://github.com/mhammond/pywin32
unknown
https://www.intel.com=
unknown
http://www.tiro.com
unknown
https://system.data.sqlite.org/X
unknown
https://www.intel.com/content/www/ru/ru/support/topics/idsa-cip.html
unknown
https://www.intel.com;
unknown
https://policy.system-usage-report.intel.com/faq/
unknown
http://www.fontbureau.com/designers
unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
unknown
http://www.goodfont.co.kr
unknown
http://creativecommons.org/publicdomain/zero/1.0/
unknown
https://www.intel.com9
unknown
http://mozilla.org/MPL/2.0/.
unknown
https://www.intel.com8
unknown
https://www.intel.fr/content/www/fr/fr/support/topics/idsa-cip.html
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
https://www.intel.co.jp/content/www/jp/ja/privacy/intel-privacy-notice.html)
unknown
http://wixtoolset.org
unknown
http://www.opensource.org).
unknown
https://www.intel.com.br/content/www
unknown
http://www.galapagosdesign.com/DPlease
unknown
https://www.intel.com/content/www/vn/vi/support/topics/idsa-cip.html
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
https://www.sqlite.org/lang_corefunc.html
unknown
http://www.urwpp.deDPlease
unknown
https://www.intel.com/content/www/tw/zh/support/topics/idsa-cip.html
unknown
http://www.zhongyicts.com.cn
unknown
https://policy.system-usage-report.
unknown
https://www.intel.it/content/www/it/it/privacy/intel-privacy-notice.html.
unknown
https://www.intel.com.br/content/www/br/pt/privacy/intel-privacy-notice.html.
unknown
http://www.sakkal.com
unknown
https://www.intel.es/content/www/es/es/support/topics/idsa-cip.html
unknown
http://www.sqlite.org/copyright.html.
unknown
https://www.intel.com/content/www/it/it/support/topics/idsa-cip.html
unknown
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
https://sectigo.com/CPS0
unknown
https://www.intel.com/content/www/tw/zh/support/topics/idsa-cip.htmlH
unknown
https://www.intel.com/content/www/th/th/support/topics/idsa-cip.html
unknown
https://www.sqlite.org/lang_aggfunc.html
unknown
https://intel.com/privacy
unknown
https://www.intel.com/content/www/cn/zh/support/topics/idsa-cip.html
unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
unknown
https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html.
unknown
http://ocsp.sectigo.com0#
unknown
https://www.intel.co.kr/content/www/kr/ko/support/topics/idsa-cip.html
unknown
http://www.carterandcone.coml
unknown
https://www.intel.com.tr/content/www/tr/tr/support/topics/idsa-cip.html
unknown
https://intel.com/privacy.
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
https://github.com/jquery/globalize
unknown
http://www.founder.com.cn/cn
unknown
https://jquery.org/
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
https://www.intel.com/content/www/us/en/support/topics/idsa-cip.html8
unknown
http://www.jiyu-kobo.co.jp/
unknown
https://www.sqlite.org/see
unknown
https://www.openssl.org/H
unknown
http://www.fontbureau.com/designers8
unknown
https://www.intel.co.jp/content/www/jp/ja/support/topics/idsa-cip.html
unknown
https://system.data.sqlite.org/
unknown
https://www.intel.com/content/www/pl/pl/support/topics/idsa-cip.html.
unknown
http://www.intel.com/privacy
unknown
https://js.foundation/
unknown
https://www.intel.com/content/www/id/id/support/topics/idsa-cip.html
unknown
https://www.intel.de/content/www/de/de/support/topics/idsa-cip.html
unknown
There are 77 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Config.Msi\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\4d7960.rbs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\4d7960.rbsLow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4DEBA2E65BA6854BB7D634412BD412E
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ECABFC3885BBAEB459DB672124A57A3B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\321B7242231FB0F49A85057FDCCFAA65
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27942822A4C04B13EAFEF97C95F63150
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8553176F1EDC3731AD2AB9E0064759F
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C9340DAD3CDC2A3FA832B02388D36F9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD2EFD8F5E4F5484898282946C589AB1
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1EA31416F42045848B8DD1E28F10CE12
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D1C5B53B5BE965338BE873EF4C52345
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD7D722D8F9DFA339B53B42F4FF7E24A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A457A50400326240B83AB05ED827BC1
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\89E10FD6ED588704BBC519A4EF16AD80
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D7380DC82784E747AAAAF40F3C85E62
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\44FD3F3D30EAB934FB712C1525D30A53
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB383865201B01755A65E57310B03994
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\66EF3B7096064164DA6E29CD32BD9713
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FAF3B3F005E8476499D0ECCF93A35DD0
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59D819A07EE7FA04488665671EF577B4
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA9B0152CC4DBEB4B872B0CE96303478
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EC4A2936BCA64D49A3500EB4DE6048B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2C617C32366E93844AC1C1C8026DE8BE
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1716931E2879F846958884E4ED3C342
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B029EC9A3BB1CEE4CA492499EF9A14FF
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\673B96B5C2DB48041AA17C5E33954566
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\143F60E19EDC7E24BB5D9F8EE8B1C1FC
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9069B8E80857E3441B6244952C4461A3
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\46B12AAFD3602104A83722882E893557
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C4C8FF969B4E6994FADE2516F06B135C
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1311C9158445E4B46930285F2D0A50C5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\911246A35BD7C05459CA8225D0B13873
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A3837A39DC753F4C812EDA1372945A5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4D6529F359B161C49A5414AE4842CAD2
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B88F3D1011370EA4C8C69DF5EEBE0BFA
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F4BAEBCD07BD8B1428F327D456503806
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FF8D343A3577B8845A1FC3775D95BE35
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B2C3C88066461D34AACE2A22EB836883
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0DFBD258FA5D2EC40A47D6E91565CDF4
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EAC703297ED5DB242AC7245CEEF4D66A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4795441AE9C8ED14A9F89EA52DEEF2D2
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\83445E896893208459CEB9EAA5EBB40D
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A58DAB9F021695439ED7DBD34527191
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2A4C67D9D5A602E4BA74B0D3FDE40FFC
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB3B7A4A1E7F98C47B1CF1486A764C97
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\75CF332BC52D9A842965163633DC20C9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\25D05D9B76BF3FF4B9F831EB67DED320
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D7C8F63CF9026CE499570F8F90FCB17A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBC18B5CAE134D04EBF581BB909FA6C4
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5617A7BCC4D14C04E951AF419D06FDB2
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8D2EBAFC725D1594C8426B92FF0277D5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19E1D75D96F633E4789EC766EDF426F8
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE93458DE73175643AC17BF22974BC83
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1EAFEE8D9084E6049B44ABD43A38D7D3
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0092D3FDE857A554AB056EB1D89C0163
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50C1A6BE7B2A10040AB96DF643A637C8
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3F60ED1F0E7FD584AB26AB222CDAC51B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\58AFBC06248B0E9488A771DFCBAB108C
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59A43E6F4591AE64E893A1411FC66642
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCF312CA0FB30384198685B87272A430
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA83D6F51396F9A45A76C3B185CE6201
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59C134B6552B33044B3A9EE93CE2412B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\318A216D1EDC21F4A96A655CCA021DF9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D4CD6141CA8253B498CC9F8E8113E6BB
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\157063085048EDA489A5631558EA130F
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\765056B4887A259408795F556BFA78FF
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0739B176751E31043911F7134643C05C
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\82EFFF336F63F8D4898B20DB6AE3F569
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EB0D343F59C8B7B44AAFBF1988B86588
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\610EC0924D7201A4087E44992DAB7109
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1B1A0468F0A166342913416A3D0AEFED
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16BCEF1CAB91904499CD21F2641B335B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\38E6188EE5952024896EC193DED2E7C4
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\210D2A1751A466244BF7E33BA0724A9D
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\065ED7135231A2744932F9C1431C1C45
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9494C5D53B2AE3E41B4DCC58E896C7A6
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CA2CA63530E2F5547BFECCD99CC5232A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EAA3FC32E97F0354891149C2B145D79A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EDD3D2CD84198B3499BDC9481CE22DBE
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E1A44BF4C0383844FBAD6D4FB292C189
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6BAA9459B53B2EE4AA43B75FCAC8D6B7
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3332BA7898052524EB7DF014232E6C59
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3477701C301C0BA448E2B92C7215B62B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AE1F877F5C23C894FB6871EB89E895D9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\30352E8CEB8040B46BCAE8C855E006F4
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26FA381F3BC43CE40B00E8B538D3E1D5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7F58B84FFD07F034AB262CB8238BC655
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\450F950F96B92E34B8A4508A9AE09125
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B75B611336471E74EAEEE99CEBF0F9F8
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6E6F20046942504DAB635A0C1D7043B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\433B565921FDC25439C623A54D6C41C5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FF421589D3D552479EC628C9B98BDE8
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B541165932897F84F9DC012E004737B5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AE62DADA7E50C884D9223CED38207CAF
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7F991B48FFF4A9F4EA9D0B1AA82CABD2
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B68900D1E9326014CB72B8ACB2267613
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9BF298B47B05D344588F063C730BAF25
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D7C2E73893443F4D8DD57E23F91F792
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F9A67E030861DE4BBF0AAC37F047272
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E56D3D3DB99677D4F8B9620F7ED6470A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6DDD41DFD1FA97458C8F219D17EA0B9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9386361C9D758CA4D93AB343964C008A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8BE3DA7B5D25D4144A8C66043D85FF33
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E630B685F1305AB4A8C3FB8972625554
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF1D9120E59E3BB4695C6189C825E3C4
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9DDEFCF51EE8A1E47A638DAAC7538C94
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CC7E8AC5414A6FA44B430ED8CDF1FBD2
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3AE9A15CB4FDE334FBD51D2D2B20D116
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6CE3F5FE101E99F4C84222BE9F410E4E
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\499DA3A3D7659674E9C2087BA61999C2
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7423E703DFA4B4549B2D5E4D1D730296
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EBF23964FE0D97441B33CA03D262EB06
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C54687F8CA3095F4194C66DA1FABCC04
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9B4FE74D3A5F4BB47885A52915FEAB8E
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\869592F57D173D44094DA0153886644C
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\57723A8540E70F24F856013B386E8034
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F306698435AF53F44935CE503F923BA9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5FE9AA61315B2764090B116B7E1D41F5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F21FDFC0BCDB186489A28BFB5BBA8F60
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6BC5A75B534427A4F895C60D9D396A2F
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\60317D64287283A41B8C8DC26CE67032
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3584791D28A58A249A6E84AA7AD3202B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF57FF45E74C1214DA1766B28BF12865
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D028CF66E36DC6646BFCDE070FF05370
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA6693B94C070904599B3CFA0807A955
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7587F1C02D8785441917E8351360AF3B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA4B248138829824B97B7BEA242CFB72
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CAB4DA6C11DB47748BEDC41F5927FBA8
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\59EF4A3EFF0AF304DA78063230AB06A6
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\943A91CD82A7BF74B99DDA53E069A2D5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C7E97430D98574C44999BD99221ED522
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\92F5ED383D5AF464C8CA340901E0EB90
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65E97B37E7D4F024089471F026C1A31E
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\48B5A988B6926604F9C6A005281763FF
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\423DA501630B6E04095E9DE51111A1D0
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2CFE41526E950F3449E37C58358718F0
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\884ABE4340FEDB04CBD6DC2F2D331A3A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9062A68E17BAB0D42ACBC388DD8EF159
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19FF7150D3F8C5245ADF28AD0EEA88D7
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12BA223C1CD6D834CA08AE6DBE4BE5BB
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88DB317DB87A43E4EA6AEB5E4F1E6DC3
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F2B405B25DDD9FD44BBA7D269F17721F
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D413C10CBB7270643BC0B68662250D05
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3D1B246A96E3CD641A11C3057850D2A2
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\93C2696E99AA44947B60ABBDA6D24FF5
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F9582CC046D3B564AAD2B595642A3AA9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E788D655B387BD54F9B4FEAF5B736371
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\284AC770803E5E34AB5432B799869140
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F174F4C949A436B409E69F4B970C6493
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F305D921632BA2F4588A98E41273F6B2
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97183796DD778549845B105303BCA6C
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1CBF9210765A48E4CBD79B16332A330B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA08B74549EB2DB4E95264BEC5AC47A6
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\51C27F9133B00BD4A9708208984FF806
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F139433C481825B44BD9731E32CEFA72
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8821E18D78BB34E42AFEA100EEE28760
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B9B4B24CC0B21C340B840E8C6FC22544
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72401997A16EFD742BB9E4E2719FCE19
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F4994072DE31B4196DA2E3688FCAEF
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4650197B28559B640BBF5FF67E571987
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\300DB0F07F7AF3640A5DF8BDCBE4A4FA
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F356872BC03730745888417ECC694269
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\271B83C41FC3BD54AAEE5C31B5ADBBF4
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2EAEF18D01D72BB47A6AE347AB01E1DA
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61C0D614668D33F4EAD3E3BE2CB09322
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE5B7E95354431947A76CD05498CFE23
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B708F5995932E4B4987D0E8364EB9B3B
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C3090B4EC33909A4093D8DBA69191378
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6D1B2AF8834E2BA489B7CD4B6138F48A
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\998CD5E815712CE4AA249624A3F7CBB9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AB2D26FB2D116B846B52CA3B06927D95
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\33C0A226CBA2A8A4E917C871F51DD6B9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C99280E94F6B192478C3C78BB8FCA92F
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\61C5C183BFE7AB74DA77A7F960B968A6
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACE9DFB3539A4BE45817AA78E7CD9B60
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\36BD25806EFA4D44A9C56ADDED8E1BAA
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FFCEB3F0E79178842B941FCFEDD64A80
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\177C4344D17F96446811430FFA47DBB0
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\075CBF893F8FD004E8C9166650B3902D
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\81E8D924F1218F943BB64BABCCFD2DDA
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\47ACE18E33F06DC49A71A72EF7042359
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\654F71F1EF9E9124B957EDC5DF6F6FB9
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FA30FAAC5DF656446906A474A5612ACF
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\05C5AF8626471565D91C7C4C9D973ACD
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\05C5AF8626471565D91C7C4C9D973ACD
00000000000000000000000000000000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1EADC9DF05AF7E25EA97751B32B04513
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1EADC9DF05AF7E25EA97751B32B04513
00000000000000000000000000000000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\79090D9DB41DC7E449DEB9BFA42F7424
8E3DA366D79E95546AF142EB3F838F95
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\ICIP\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\QUEENCREEK\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\Registry\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\downloads\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\history\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\update_events\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\persisted_updates\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Intel\SUR\QUEENCREEK\Updater\AppData\captured_logs\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\QUEENCREEK\x64\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\pywin32_system32\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\x64\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files\Intel\SUR\QUEENCREEK\Updater\bin\api\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
PatchGUID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
MediaCabinet
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
ComponentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
ProductVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
PatchSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
PatchAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
PatchSequence
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
SharedComponent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DF85233BC05724B3B84E35B5849ED74B\8E3DA366D79E95546AF142EB3F838F95
IsFullFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\321B7242231FB0F49A85057FDCCFAA65\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27942822A4C04B13EAFEF97C95F63150\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8553176F1EDC3731AD2AB9E0064759F\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6C9340DAD3CDC2A3FA832B02388D36F9\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD2EFD8F5E4F5484898282946C589AB1\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1EA31416F42045848B8DD1E28F10CE12\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2D1C5B53B5BE965338BE873EF4C52345\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FD7D722D8F9DFA339B53B42F4FF7E24A\8E3DA366D79E95546AF142EB3F838F95
File
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\vcruntime140.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\vcruntime140_1.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\msvcp140.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\msvcp140_1.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\msvcp140_2.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\msvcp140_atomic_wait.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\msvcp140_codecvt_ids.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\concrt140.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs
C:\Windows\system32\vccorlib140.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Intel\SUR
GUID
There are 231 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
24B0E80B000
heap
page read and write
24B0EB40000
heap
page read and write
63814FF000
unkown
page read and write
24B0EA20000
heap
page read and write
7FFD9B3D4000
trusted library allocation
page read and write
27B0000
heap
page read and write
24B28FE4000
heap
page execute and read and write
1CCE681A000
heap
page read and write
24B20587000
trusted library allocation
page read and write
24B28FE0000
heap
page execute and read and write
6C638F4000
stack
page read and write
24B2BC4F000
heap
page read and write
24B28E80000
heap
page read and write
24B0EB00000
trusted library allocation
page read and write
2630000
heap
page read and write
24B28C50000
heap
page read and write
1CCE67F0000
heap
page read and write
1CCE6640000
heap
page read and write
23DD000
stack
page read and write
24B0E6A0000
unkown
page readonly
24B2BE37000
trusted library allocation
page read and write
24B20581000
trusted library allocation
page read and write
69D47AF000
stack
page read and write
28D0000
heap
page read and write
24B0E7F0000
heap
page read and write
24B0EB45000
heap
page read and write
27E0000
heap
page read and write
2750000
heap
page read and write
1CCE67F5000
heap
page read and write
69D4A7F000
stack
page read and write
24B2BC56000
heap
page read and write
1CCE6740000
heap
page read and write
69D472B000
stack
page read and write
17082BE0000
heap
page read and write
7FFD9B3DB000
trusted library allocation
page execute and read and write
24B10410000
heap
page read and write
7FFD9B40C000
trusted library allocation
page execute and read and write
7FFD9B3BD000
trusted library allocation
page execute and read and write
24B106FB000
trusted library allocation
page read and write
86224FF000
unkown
page read and write
17082AA5000
heap
page read and write
1AF75C30000
heap
page read and write
24B0EB10000
heap
page read and write
24B0E82D000
heap
page read and write
24B0EA72000
unkown
page readonly
24B0E85E000
heap
page read and write
6C63BFF000
stack
page read and write
24B0E6C8000
unkown
page readonly
7FFD9B4D0000
trusted library allocation
page execute and read and write
24B2BC39000
heap
page read and write
1AF75ED5000
heap
page read and write
24B28DF3000
heap
page read and write
24B20599000
trusted library allocation
page read and write
24B0E7C0000
heap
page read and write
1CCE6720000
heap
page read and write
24B10592000
trusted library allocation
page read and write
7FFD9B3DD000
trusted library allocation
page execute and read and write
6C63EFE000
stack
page read and write
24B28C98000
heap
page read and write
24B0EA40000
trusted library allocation
page read and write
24B10570000
heap
page execute and read and write
24B2BDFF000
trusted library allocation
page read and write
24B0E80F000
heap
page read and write
24B0E6A0000
unkown
page readonly
24B0EA25000
heap
page read and write
24B0E8E2000
heap
page read and write
24B2BE0F000
trusted library allocation
page read and write
24B28DF0000
heap
page read and write
22DD000
stack
page read and write
7FFD9B3D0000
trusted library allocation
page read and write
24B28DD0000
heap
page execute and read and write
17082AE0000
heap
page read and write
24B28DB0000
heap
page read and write
1CCE6910000
heap
page read and write
24B0EA74000
unkown
page readonly
7FFD9B3CD000
trusted library allocation
page execute and read and write
7FFD9B553000
trusted library allocation
page read and write
24B0E9C0000
heap
page read and write
24B2BD35000
trusted library allocation
page read and write
24B0E7A0000
heap
page read and write
1CCE6810000
heap
page read and write
24B10841000
trusted library allocation
page read and write
24B0E790000
heap
page read and write
6C63DFF000
stack
page read and write
638114D000
stack
page read and write
7FFD9B3C0000
trusted library allocation
page read and write
24B10829000
trusted library allocation
page read and write
24B1059C000
trusted library allocation
page read and write
24B0EA43000
trusted library allocation
page read and write
7FFD9B560000
trusted library allocation
page execute and read and write
24B0EA30000
trusted library allocation
page read and write
24B2BC30000
heap
page read and write
6C63CFD000
stack
page read and write
279E000
stack
page read and write
17082910000
heap
page read and write
24B0E8E6000
heap
page read and write
7FFD9B460000
trusted library allocation
page read and write
24B28DB5000
heap
page read and write
86225FF000
stack
page read and write
24B2BE50000
trusted library allocation
page read and write
24B28C9F000
heap
page read and write
24B0EB20000
heap
page read and write
24B0E815000
heap
page read and write
24B0E6FC000
unkown
page readonly
28D7000
heap
page read and write
24B0E7F8000
heap
page read and write
1AF75D80000
heap
page read and write
7FFD9B3B2000
trusted library allocation
page read and write
6C640FC000
stack
page read and write
7FFD9B466000
trusted library allocation
page read and write
24B0EA00000
trusted library allocation
page read and write
24B0EA70000
unkown
page readonly
7FFD9B3B4000
trusted library allocation
page read and write
274E000
unkown
page read and write
17082AA0000
heap
page read and write
7FFD9B570000
trusted library allocation
page read and write
7FFD9B496000
trusted library allocation
page execute and read and write
24B0E859000
heap
page read and write
17082A10000
heap
page read and write
1AF75C6A000
heap
page read and write
1AF75D60000
heap
page read and write
7FFD9B470000
trusted library allocation
page execute and read and write
24B0E6A2000
unkown
page readonly
24B2BE1F000
trusted library allocation
page read and write
170829F0000
heap
page read and write
2ACF000
unkown
page read and write
1AF75B50000
heap
page read and write
63815FF000
stack
page read and write
24B28C40000
heap
page read and write
24B10808000
trusted library allocation
page read and write
24B2BEE0000
trusted library allocation
page read and write
24B0E82F000
heap
page read and write
24B10581000
trusted library allocation
page read and write
6C63FFE000
stack
page read and write
24B0E8E9000
heap
page read and write
7FFD9B3B3000
trusted library allocation
page execute and read and write
24B20591000
trusted library allocation
page read and write
24B2A012000
trusted library allocation
page read and write
7FF497980000
trusted library allocation
page execute and read and write
17082AE8000
heap
page read and write
24B0EAB0000
heap
page read and write
7FFD9B550000
trusted library allocation
page read and write
7FFD9B3C2000
trusted library allocation
page read and write
7FFD9B46C000
trusted library allocation
page execute and read and write
2BCF000
stack
page read and write
1AF75C60000
heap
page read and write
24B29FF0000
trusted library allocation
page read and write
24B0E818000
heap
page read and write
1AF75ED0000
heap
page read and write
862213D000
stack
page read and write
24B0EAF0000
trusted library section
page readonly
24B0E6D5000
unkown
page readonly
24B205A6000
trusted library allocation
page read and write
There are 143 hidden memdumps, click here to show them.