"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "SetupDiag.exe /Output:C:\SetupDiag\Results.txt /LogsPath:D:\Temp\Logs\Logs1 /RegPath:HKEY_CURRENT_USER\SYSTEM\SetupDiag" in Source: sample.bin, "hku\" in Source: sample.bin, "uninstall))\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\sInfo\s+MOUPG\s+SetupHost::Initialize:\sCmdLine\s+=\s\[/(?.+)\s/RollbackSys)\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\s+Info\s+MOUPG\s+CInstallUI::ShowRollbackPage)\]\]> \s+Info\s+SP\s+Antivirus\ssoftware\sinformation:\r\n\s+Name:\s(?[\w\s]+),)\]\]> \s+New\sfilter\sdriver\sName:\s(?\w+),)\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [0-9a-fA-Z" in Source: sample.bin, "hklm\" in Source: sample.bin, "hkcu\" in Source: sample.bin, "> failed\sto\sextract\sfile\sfrom\sreference\sextension\]\s(?.+)\s\(Error\s=\s(?[\d]+)\))\]\]> Error\s+SP\s+Operation\sfailed:\sApply\sWIM\sfile\sPathForNewOSFile(?:\s\(compact\))?,\sindex\s[\d]+\sto\s(?.+)\sError:\s(?0x\w{8}))\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\sInfo\s+MOUPG\s+SetupHost::Initialize:\sCmdLine\s+=\s\[/(?.+)\s/RollbackSys)\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\s+Info\s+MOUPG\s+CInstallUI::ShowRollbackPage)\]\]> \s+Info\s+SP\s+Antivirus\ssoftware\sinformation:\r\n\s+Name:\s(?[\w\s]+),)\]\]> \s+New\sfilter\sdriver\sName:\s(?\w+),)\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [0-9a-fA-Z]" in Source: sample.bin, "nt.sys file version. Last Phase: %LastPhase% Last Operation: %LastOperation% DriverPath: %DriverPath% Error = %Error%" Args=""> failed\sto\sextract\sfile\sfrom\sreference\sextension\]\s(?.+)\s\(Error\s=\s(?[\d]+)\))\]\]> Error\s+SP\s+Operation\sfailed:\sApply\sWIM\sfile\sPathForNewOSFile(?:\s\(" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "