"sonal=!\My Documents> 00070000|TSU:D0001|0409|PhysicalMemory|3072 00070000|TSU:D0001|0409|PowerShell|<@\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell\Path> 00070000|TSU:D0001|0409|PreinstallFolder|\ 00070000|TSU:D0001|0409|Prerequisites|<#??Prerequisites> 00070000|TSU:D0001|0409|PreviousProductSection| 00070000|TSU:D0001|0409|PreviousScreenID|0 00070000|TSU:D0001|0409|PRIMARYFOLDER|INSTALLDIR 00070000|TSU:D0001|0409|PrimaryVolumePath|C: 00070000|TSU:D0001|0409|PrimaryVolumeSpaceAvailable|24974282752 00070000|TSU:D0001|0409|PrimaryVolumeSpaceRemaining|24974282752 00070000|TSU:D0001|0409|PrimaryVolumeSpaceRequired| 00070000|TSU:D0001|0409|PrintHoodFolder|<@\PrintHood=!\PrintHood> 00070000|TSU:D0001|0409|ProcessRunning|0 00070000|TSU:D0001|0409|ProductAppDataFolder|\ 00070000|TSU:D0001|0409|ProductChannel| 00070000|TSU:D0001|0409|ProductCode|{A5A940A1-21B2-" in Source: sample.bin, "ileFolder>\Templates> 00070000|TSU:D0001|0409|CompanyAppDataFolder|\ 00070000|TSU:D0001|0409|ComputerName|<@\System\CurrentControlSet\Control\ComputerName\ComputerName\ComputerName> 00070000|TSU:D0001|0409|ComSpec|<%ComSpec> 00070000|TSU:D0001|0409|ConfigQuery|installer_id=6720232588247556644&publisher_id=964&source_id=0&page_id=0&affiliate_id=0&country_code=US&locale=EN&browser_id=0&download_id=5944217041600035952&external_id=0 00070000|TSU:D0001|0409|ConfirmationResult| 00070000|TSU:D0001|0409|ConfirmProduct|<#??Confirm> 00070000|TSU:D0001|0409|ConnectionIssuesCounter|0 00070000|TSU:D0001|0409|ConnectionReceiveTimeout|600000 00070000|TSU:D0001|0409|ControlID|2100 00070000|TSU:D0001|0409|CookiesFolder|<$shpath(33)=@\Cookies=!\Cookies> 00070000|TSU:D0001|0409|Copyright|Copyright " in Source: sample.bin, "TSU:D0003|0409|RegCurrentVersionHKLM|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion 00070002|TSU:D0003|0409|HKCR|HKEY_CLASSES_ROOT 00070005|TSU:D0006|0409|RegUninstallHKAU|\Uninstall|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Uninstall 00070002|TSU:D0003|0409|RegUninstallHKAU|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Uninstall 00070005|TSU:D0006|0409|RegMIMEContentTypes|\Content Type|HKEY_CLASSES_ROOT\MIME\Database\Content Type 00070002|TSU:D0003|0409|RegMIMEContentTypes|HKEY_CLASSES_ROOT\MIME\Database\Content Type 00070005|TSU:D0006|0409|RegMicrosoftHKCU|\Microsoft|HKEY_CURRENT_USER\Software\Microsoft 00070002|TSU:D0003|0409|RegMicrosoftHKCU|HKEY_CURRENT_USER\Software\Microsoft 00070002|TSU:D0003|0409|HKCU|HKEY_CURRENT_USER 0007203D|TSU:I0062|0409 00072020|TSU:I0033|0409|ResolvePaths|0 00070019|TSU:D0026|0409|PauseServices||-1 00072008|TSU:I0009|0409|PauseServices|Pausing services 00070005|TSU:D0006|0409|TsuAc" in Source: sample.bin, "Features||-1 00072008|TSU:I0009|0409|InitFeatures|Initializing feature selections 00070005|TSU:D0006|0409|UninstallRegPath|\\Uninstall\|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A5A940A1-21B2-4660-A48B-69907E4A6257} 00072020|TSU:I0033|0409|InitFeatures|0 00070019|TSU:D0026|0409|UpdateComponents||-1 00072008|TSU:I0009|0409|UpdateComponents|Updating components 00070005|TSU:D0006|0409|CeDeviceRequired||0 00070005|TSU:D0006|0409|TsuInstallSize||0 00070005|TSU:D0006|0409|TsuRemoveSize||0 00070005|TSU:D0006|0409|PrimaryVolumeSpaceRequired||0 00072020|TSU:I0033|0409|UpdateComponents|0 00070019|TSU:D0026|0409|SetInstallDir|InstallLocation|0 0007201F|TSU:I0032|0409|SetInstallDir 00070019|TSU:D0026|0409|FirstInstallUI|NOT TsuQuiet|1 00072008|TSU:I0009|0409|FirstInstallUI|Transferring to action sequence 00070019|TSU:D0026|0409|LoadCustomerInfo|UIRegistrationPage|0 0007201F|TSU:I0032|0409|LoadCustomerInfo 00070019|TSU:D0026|0409|RunMainInstall||-1 00072008|TSU:I000" in Source: sample.bin, "0000|TSU:D0001|0409|InstallDate|20260906 00070000|TSU:D0001|0409|INSTALLDIR|\ 00070000|TSU:D0001|0409|Installed|0 00070000|TSU:D0001|0409|InstalledAntivirusInfo| 00070000|TSU:D0001|0409|InstalledChromeVersion|<$fverp("\Google\Chrome\Application\chrome.exe")> 00070000|TSU:D0001|0409|InstalledDotNetVersion| 00070000|TSU:D0001|0409|InstalledFirefoxVersion|<$fverp("\Mozilla Firefox\firefox.exe")> 00070000|TSU:D0001|0409|InstalledFlashVersion|<$part(<@\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CurVer\>,.,-1)> 00070000|TSU:D0001|0409|InstalledIEVersion|<$fverp("\Internet Explorer\iexplore.exe")> 00070000|TSU:D0001|0409|InstalledJavaVersion|<@\SOFTWARE\JavaSoft\Java Runtime Environment\CurrentVersion> 00070000|TSU:D0001|0409|InstalledMSIVersion| 00070000|TSU:D0001|0409|InstalledMSXMLVersion|<$fverp(\msxml6.dll)> 00070000|TSU:D0001|0409|InstalledRunTimeVersion|0 00070000" in Source: sample.bin, "mFolder|C:\Windows\system32 00070000|TSU:D0001|0409|SystemLanguageID|1033 00070000|TSU:D0001|0409|SystemXFolder|\System32 00070000|TSU:D0001|0409|TARGETDIR| 00070000|TSU:D0001|0409|TempFolder|C:\Users\HAPUBWS\AppData\Local\Temp 00070000|TSU:D0001|0409|TemplateFolder|<$shpath(21)=@\Templates=!\Templates> 00070000|TSU:D0001|0409|TerminalServer| 00070000|TSU:D0001|0409|TestSymbol| 00070000|TSU:D0001|0409|Time|7:22:45 PM 00070000|TSU:D0001|0409|TinComponentsKey|\Components 00070000|TSU:D0001|0409|TinFolder|\InstallMate 00070000|TSU:D0001|0409|TinProductFolder|C:\ProgramData\InstallMate\{A5A940A1-21B2-4660-A48B-69907E4A6257} 00070000|TSU:D0001|0409|TinProductsKey|\Products 00070000|TSU:D0001|0409|TinRegistryPath|\Software\InstallMate 00070000|TSU:D0001|0409|TizPath|C:\a413f1850ed6c9b7e8688b7a0666703f82a363d34da9f41246f429e1e3865f7e.exe 00070000|TSU:D0001|0409|TopMost|<#?\Software|HKEY_CURRENT_USER\Software 00070002|TSU:D0003|0409|RegSoftwareHKCU|HKEY_CURRENT_USER\Software 00070002|TSU:D0003|0409|HKLM|HKEY_LOCAL_MACHINE 00070005|TSU:D0006|0409|RegMicrosoftHKLM|\Microsoft|HKEY_LOCAL_MACHINE\Software\Microsoft 00070002|TSU:D0003|0409|RegMicrosoftHKLM|HKEY_LOCAL_MACHINE\Software\Microsoft 00070002|TSU:D0003|0409|UninstallRegPath|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A5A940A1-21B2-4660-A48B-69907E4A6257} 00070002|TSU:D0003|0409|HKU|HKEY_USERS 00070005|TSU:D0006|0409|RegInterface|\Interface|HKEY_CLASSES_ROOT\Interface 00070002|TSU:D0003|0409|RegInterface|HKEY_CLASSES_ROOT\Interface 00070005|TSU:D0006|0409|MSOffice|\Software\Microsoft\Office|HKEY_LOCAL_MACHINE\Software\Microsoft\Office 00070002|TSU:D0003|0409|MSOffice|HKEY_LOCAL_MACHINE\Software\Microsoft\Office 00070005|TSU:D0006|0409|Reg" in Source: sample.bin, "ows\CurrentVersion 00070005|TSU:D0006|0409|RegCurrentVersionHKAU|\CurrentVersion|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion 00070002|TSU:D0003|0409|RegCurrentVersionHKAU|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion 00070005|TSU:D0006|0409|RegAppID|\AppID|HKEY_CLASSES_ROOT\AppID 00070002|TSU:D0003|0409|RegAppID|HKEY_CLASSES_ROOT\AppID 00070005|TSU:D0006|0409|RegMIME|\MIME|HKEY_CLASSES_ROOT\MIME 00070002|TSU:D0003|0409|RegMIME|HKEY_CLASSES_ROOT\MIME 00070005|TSU:D0006|0409|RegWindowsHKAU|\Windows|HKEY_ALL_USERS\Software\Microsoft\Windows 00070002|TSU:D0003|0409|RegWindowsHKAU|HKEY_ALL_USERS\Software\Microsoft\Windows 00070002|TSU:D0003|0409|HKAU|HKEY_ALL_USERS 00070005|TSU:D0006|0409|RegTypeLib|\TypeLib|HKEY_CLASSES_ROOT\TypeLib 00070002|TSU:D0003|0409|RegTypeLib|HKEY_CLASSES_ROOT\TypeLib 00070005|TSU:D0006|0409|RegCurrentVersionHKLM|\CurrentVersion|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion 00070002|" in Source: sample.bin, "WindowsHKCU|\Windows|HKEY_CURRENT_USER\Software\Microsoft\Windows 00070002|TSU:D0003|0409|RegWindowsHKCU|HKEY_CURRENT_USER\Software\Microsoft\Windows 00070005|TSU:D0006|0409|RegCLSID|\CLSID|HKEY_CLASSES_ROOT\CLSID 00070002|TSU:D0003|0409|RegCLSID|HKEY_CLASSES_ROOT\CLSID 00070005|TSU:D0006|0409|RegWindowsHKLM|\Windows|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows 00070002|TSU:D0003|0409|RegWindowsHKLM|HKEY_LOCAL_MACHINE\Software\Microsoft\Windows 00070005|TSU:D0006|0409|RegSoftwareHKAU|\Software|HKEY_ALL_USERS\Software 00070002|TSU:D0003|0409|RegSoftwareHKAU|HKEY_ALL_USERS\Software 00070005|TSU:D0006|0409|RegMIMEDatabase|\Database|HKEY_CLASSES_ROOT\MIME\Database 00070002|TSU:D0003|0409|RegMIMEDatabase|HKEY_CLASSES_ROOT\MIME\Database 00070005|TSU:D0006|0409|RegCurrentVersionHKCU|\CurrentVersion|HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion 00070002|TSU:D0003|0409|RegCurrentVersionHKCU|HKEY_CURRENT_USER\Software\Microsoft\Wind" in Source: sample.bin, " 00070000|TSU:D0001|0409|USERNAME| 00070000|TSU:D0001|0409|UserSelection|0 00070000|TSU:D0001|0409|UserSettingsSection| 00070000|TSU:D0001|0409|UserSID|S-1-5-21-2092356043-4041700817-663127204-1001 00070000|TSU:D0001|0409|ValidatePercentage|0 00070000|TSU:D0001|0409|ValidateProduct|<#??Validate> 00070000|TSU:D0001|0409|Version9X|0 00070000|TSU:D0001|0409|VersionCLR|4000 00070000|TSU:D0001|0409|VersionIE|9000 00070000|TSU:D0001|0409|VersionJRE| 00070000|TSU:D0001|0409|VersionMDAC|601 00070000|TSU:D0001|0409|VersionMsi|5.0.7601.23593 00070000|TSU:D0001|0409|VersionNT|601 00070000|TSU:D0001|0409|VersionNT32|601 00070000|TSU:D0001|0409|VersionNT64|0 00070000|TSU:D0001|0409|VersionPS|<@\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine\PowerShellVersion> 00070000|TSU:D0001|0409|VersionTin|7027 00070000|TSU:D0001|0409|VirtualMemory|6142 00070000|TSU:D0001|0409|WaitForRestart|0 00070000|TSU:D0001|0409|WinCurVer|Software\Microsoft\Windows\CurrentVersion 00070000|TSU:D00" in Source: sample.bin, "DDEN* 00070000|TSU:D0001|0409|ExistedStepID|<#??ExistedStepID> 00070000|TSU:D0001|0409|ExpandCab|<#??ExpandCab> 00070000|TSU:D0001|0409|ExternalID|0 00070000|TSU:D0001|0409|ExtractPayload|0 00070000|TSU:D0001|0409|ExtraSize|0 00070000|TSU:D0001|0409|FailedStepID|<#??FailedStepID> 00070000|TSU:D0001|0409|FavoritesFolder|<$shpath(6)=@\Favorites=!\Favorites> 00070000|TSU:D0001|0409|FirefoxExtentionRegPath|\Software\Mozilla\Firefox\Extensions 00070000|TSU:D0001|0409|FireFoxRunning|0 00070000|TSU:D0001|0409|FontsFolder|<$shpath(20)=@\Fonts=!\Fonts> 00070000|TSU:D0001|0409|GameBoxFolder|\GameBox\ 00070000|TSU:D0001|0409|GeneralIconID|101 00070000|TSU:D0001|0409|GlobalAssemblyCache|C:\Windows\assembly 00070000|TSU:D0001|0409|HardwareID|12734794904846621615 00070000|TSU:D0001|0409|HardwareIDx64| 00070000|TSU:D0001|0409|Hel" in Source: sample.bin, "2008|TSU:I0009|0409|AddReportJava|Setting internal variable 00070005|TSU:D0006|0409|ReportInstallerSoftware|"installer_software":[{"n":"|Installmate Internet Explorer|", "v":"|11.0.9600.18838|"},{"n":"|Installmate Firefox|", "v":"|57.0.1.0|"},{"n":"|Installmate Microsoft .NET|", "v":"|4000|"},|"installer_software":[{"n":"|Installmate Internet Explorer|", "v":"|11.0.9600.18838|"},{"n":"|Installmate Firefox|", "v":"|57.0.1.0|"},{"n":"|Installmate Microsoft .NET|", "v":"|4000|"},{"n":"|Installmate Java Run Time|", "v":"|1.8|"}, 00072020|TSU:I0033|0409|AddReportJava|0 00070019|TSU:D0026|0409|AddReportFlash|<@\SOFTWARE\Classes\ShockwaveFlash.ShockwaveFlash\CurVer\> ~<> ""|1 00072008|TSU:I0009|0409|AddReportFlash|Setting internal variable 00070005|TSU:D0006|0409|ReportInstallerSoftware|"installer_software":[{"n":"|Installmate Internet Explorer|", "v":"|11.0.9600.18838|"},{"n":"|Installmate Firefox|", "v":"|57.0.1.0|"},{"n":"|Installmate Microsoft .NET|", "v":"|4000|"},{"n":"|Installmate Java Run Time|", "v":"" in Source: sample.bin, "leType|\FileType 00070000|TSU:D0001|0409|RegIEVersion|<@\Software\Microsoft\Internet Explorer\Version> 00070000|TSU:D0001|0409|RegInterface|\Interface 00070000|TSU:D0001|0409|RegMDAC|\Software\Microsoft\DataAccess 00070000|TSU:D0001|0409|RegMDACVersion|<@\Version> 00070000|TSU:D0001|0409|RegMicrosoftHKAU|\Microsoft 00070000|TSU:D0001|0409|RegMicrosoftHKCU|\Microsoft 00070000|TSU:D0001|0409|RegMicrosoftHKLM|\Microsoft 00070000|TSU:D0001|0409|RegMIME|\MIME 00070000|TSU:D0001|0409|RegMIMEContentTypes|\Content Type 00070000|TSU:D0001|0409|RegMIMEDatabase|\Database 00070000|TSU:D0001|0409|RegNTProductType|<@\System\CurrentControlSet\Control\ProductOptions\ProductType> 00070000|TSU:D0001|0409|RegOrganization|<@\\RegisteredOrganization> 00070000|TSU:D0001|0409|RegOwner|<@\\RegisteredOwner> 00070000|TSU:D0001|0409|RegSoftwareHKAU|\Software 00070000|TSU:D" in Source: sample.bin, "older|<$shpath(26)=@\AppData=!\Application Data>|C:\Users\HAPUBWS\AppData\Roaming 00070001|TSU:D0002|0409|AppDataFolder|C:\Users\HAPUBWS\AppData\Roaming 00070005|TSU:D0006|0409|PreinstallFolder|\|C:\Users\HAPUBWS\AppData\Local\Temp\{A5A940A1-21B2-4660-A48B-69907E4A6257} 00070001|TSU:D0002|0409|PreinstallFolder|C:\Users\HAPUBWS\AppData\Local\Temp\{A5A940A1-21B2-4660-A48B-69907E4A6257} 00070005|TSU:D0006|0409|PersonalFolder|<$shpath(5)=@\Personal=!\My Documents>|C:\Users\HAPUBWS\Documents 00070001|TSU:D0002|0409|PersonalFolder|C:\Users\HAPUBWS\Documents 00070005|TSU:D0006|0409|RegFileType|\FileType|HKEY_CLASSES_ROOT\FileType 00070002|TSU:D0003|0409|RegFileType|HKEY_CLASSES_ROOT\FileType 00070005|TSU:D0006|0409|RegSoftwareHKLM|\Software|HKEY_LOCAL_MACHINE\Software 00070002|TSU:D0003|0409|RegSoftwareHKLM|HKEY_LOCAL_MACHINE\Software 00070005|TSU:D0006|0409|RegMicrosoftHKAU|\Microsoft|HKEY_ALL_USERS\Sof" in Source: sample.bin, "01|0409|WinCurVerNT|Software\Microsoft\Windows NT\CurrentVersion 00070000|TSU:D0001|0409|WindowsBuild|7601 00070000|TSU:D0001|0409|WindowsCore|0 00070000|TSU:D0001|0409|WindowsFolder|C:\Windows 00070000|TSU:D0001|0409|WindowsRunRegistryPath|\\Run 00070000|TSU:D0001|0409|WindowsType|48 00070000|TSU:D0001|0409|WindowsVolume|C: 00070000|TSU:D0001|0409|WinSxSFolder|\WinSxS 00070000|TSU:D0001|0409|WinSxSManifestsFolder|\Manifests 00070000|TSU:D0001|0409|WinSxSPoliciesFolder|\Policies 00070000|TSU:D0001|0409|WWWRootFolder|<$iispath(/LM/W3SVC/1/Root)=!\wwwroot> 00070000|TSU:D0001|0409|x64|0 00070000|TSU:D0001|0409|XCheckbox1_Condition| 00070000|TSU:D0001|0409|XCheckbox1_Variable|XCheckbox1_Variable 00070000|TSU:D0001|0409|XCopy|\xcopy.exe 00072020|TSU:I0033|0409|RedirectFolders|0 00070019|TSU:D0026|0409|InitializeStart|TsuRunMode = 1 and WaitForRestart = 0|1 00072008|TSU:I0009|0409|InitializeStart|Running action sequence 0007001" in Source: sample.bin, "|Creating shortcuts 00072020|TSU:I0033|0409|CreateShortcuts|0 00072027|TSU:I0040|0409|RegisterProduct|Registering the product 00070009|TSU:D0010|0409|sfc.dll|72A50000 0007000B|TSU:D0012|0409|72A50000|SfcIsKeyProtected|6EBE36CB 00074003|TSU:A0004|0409|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A5A940A1-21B2-4660-A48B-69907E4A6257}\UninstallString|C:\PROGRA~2\INSTAL~1\{A5A94~1\Setup.exe /remove /q0 00074003|TSU:A0004|0409|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A5A940A1-21B2-4660-A48B-69907E4A6257}\QuietUninstallString|C:\PROGRA~2\INSTAL~1\{A5A94~1\Setup.exe /remove /q 00074030|TSU:A0049|0409|{1298F6E9-9E4C-4B3B-9549-0E50C623D394}|HKEY_ALL_USERS\Software\Microsoft\Windows\CurrentVersion\Uninstall\{A5A940A1-21B2-4660-A48B-69907E4A6257} 00072020|TSU:I0033|0409|RegisterProduct|0 0007203F|TSU:I0064|0409 00072005|TSU:I0006|0409|1|2 00070005|TSU:D0006|0409|TsuStatus|1|2 00072020|TSU:I0033|0409|EndProcessing|0 00070019|TSU:D0026|0409|EndSequence|TsuStatus < 2|0 0007" in Source: sample.bin, " "v":"|11.0.9600.18838|"},|"installer_software":[{"n":"|Installmate Internet Explorer|", "v":"|11.0.9600.18838|"},{"n":"|Installmate Firefox|", "v":"|57.0.1.0|"}, 00072020|TSU:I0033|0409|AddReportFirefox|0 00070019|TSU:D0026|0409|AddReportChrome|<$fexist("\Google\Chrome\Application\chrome.exe")> > 0|0 0007201F|TSU:I0032|0409|AddReportChrome 00070019|TSU:D0026|0409|AddReportDotNet| ~<> "0"|1 00072008|TSU:I0009|0409|AddReportDotNet|Setting internal variable 00070005|TSU:D0006|0409|ReportInstallerSoftware|"installer_software":[{"n":"|Installmate Internet Explorer|", "v":"|11.0.9600.18838|"},{"n":"|Installmate Firefox|", "v":"|57.0.1.0|"},|"installer_software":[{"n":"|Installmate Internet Explorer|", "v":"|11.0.9600.18838|"},{"n":"|Installmate Firefox|", "v":"|57.0.1.0|"},{"n":"|Installmate Microsoft .NET|", "v":"|4000|"}, 00072020|TSU:I0033|0409|AddReportDotNet|0 00070019|TSU:D0026|0409|AddReportJava|<@\SOFTWARE\JavaSoft\Java Runtime Environment\CurrentVersion> ~<> ""|1 0007" in Source: sample.bin, "2 00070000|TSU:D0001|0409|BuildDate|20140318 00070000|TSU:D0001|0409|BuildTime|173556 00070000|TSU:D0001|0409|ButtonCancelText|Cancel 00070000|TSU:D0001|0409|ButtonTryAgainText|Try Again 00070000|TSU:D0001|0409|CacheFolder|<$shpath(32)=@\Cache=!\Temporary Internet Files> 00070000|TSU:D0001|0409|CCIsrael|IL 00070000|TSU:D0001|0409|CeAppMgr|<@\\App Paths\CEAppMgr.exe\> 00070000|TSU:D0001|0409|CeDeviceID| 00070000|TSU:D0001|0409|CeDeviceRequired| 00070000|TSU:D0001|0409|CeVersion| 00070000|TSU:D0001|0409|CeVersionAppMgr|0.0.0.0 00070000|TSU:D0001|0409|CfgFolder|\cfg 00070000|TSU:D0001|0409|CfgPath| 00070000|TSU:D0001|0409|CfgSchedulerPath|\scheduler.ini 00070000|TSU:D0001|0409|CheckProcess|<$ifte("<#??CheckProcess>" ~= "0",0,1)> 00070000|TSU:D0001|0409|ChromeExtentionRegPath|\Software\Google\Chrome\Extensions 00070000|TSU:D0001|0409|ChromeRunning|0 00070000|TSU:D0001|0409|ClickID|<#\\ProgramFilesDir> 00070000|TSU:D0001|0409|ProgramGroupFolder|\ 00070000|TSU:D0001|0409|ProgramMenuFolder|<$shpath(2)=@\Programs=!\Programs> 00070000|TSU:D0001|0409|ProgressBarVisibility|0 00070000|TSU:D0001|0409|Publisher|ApPure 00070000|TSU:D0001|0409|PublisherID|964 00070000|TSU:D0001|0409|QueryString|installer_file_name=la&filesize=&product_name=Your+File 00070000|TSU:D0001|0409|QueryStringID|3594840564999173621 00070000|TSU:D0001|0409|QuickLaunchFolder|\Quick Launch 00070000|TSU:D0001|0409|RecentFolder|<$shpath(8)=@\Recent=!\Recent> 00070000|TSU:D0001|0409|RefererDomainID| 00070000|TSU:D0001|0409|REG_DWORD|4 00070000|TSU:D0001|0409|REG_SZ|1 00070000|TSU:D0001|0409|RegAppID|\AppID 00070000|TSU:D0001|0409|RegCLR2Version|<@\Software\Microsoft\Net Framework Setup\NDP\v2.0.50727\Version> 00070000|TSU:D0001|0409|RegCLR35Version|<" in Source: sample.bin, "@\Software\Microsoft\Net Framework Setup\NDP\v3.5\Version=@\Software\Microsoft\Net Framework Setup\NDP\v3.5\Setup\Version> 00070000|TSU:D0001|0409|RegCLR3Version|<@\Software\Microsoft\Net Framework Setup\NDP\v3.0\Version=@\Software\Microsoft\Net Framework Setup\NDP\v3.0\Setup\Version> 00070000|TSU:D0001|0409|RegCLR4ClientVersion|<@\Software\Microsoft\Net Framework Setup\NDP\v4\Client\Version> 00070000|TSU:D0001|0409|RegCLR4FullVersion|<@\Software\Microsoft\Net Framework Setup\NDP\v4\Full\Version> 00070000|TSU:D0001|0409|RegCLR4Version|<@\Software\Microsoft\Net Framework Setup\NDP\v4\Full\Version=@\Software\Microsoft\Net Framework Setup\NDP\v4\Client\Version> 00070000|TSU:D0001|0409|RegCLSID|\CLSID 00070000|TSU:D0001|0409|RegCurrentVersionHKAU|\CurrentVersion 00070000|TSU:D0001|0409|RegCurrentVersionHKCU|\CurrentVersion 00070000|TSU:D0001|0409|RegCurrentVersionHKLM|\CurrentVersion 00070000|TSU:D0001|0409|RegFi" in Source: sample.bin, "0001|0409|MsiNTSuiteEnterprise| 00070000|TSU:D0001|0409|MsiNTSuitePersonal| 00070000|TSU:D0001|0409|MsiNTSuiteSmallBusiness| 00070000|TSU:D0001|0409|MsiNTSuiteSmallBusinessRestricted| 00070000|TSU:D0001|0409|MsiNTSuiteWebServer| 00070000|TSU:D0001|0409|MsiWin32AssemblySupport|6.1.7601.17514 00070000|TSU:D0001|0409|Msix64| 00070000|TSU:D0001|0409|MSOffice|\Software\Microsoft\Office 00070000|TSU:D0001|0409|MSOfficeDir10|<@\10.0\Common\InstallRoot\Path> 00070000|TSU:D0001|0409|MSOfficeDir11|<@\11.0\Common\InstallRoot\Path> 00070000|TSU:D0001|0409|MSOfficeDir12|<@\12.0\Common\InstallRoot\Path> 00070000|TSU:D0001|0409|MSOfficeDir8|<@\8.0\BinDirPath> 00070000|TSU:D0001|0409|MSOfficeDir9|<@\9.0\Common\InstallRoot\Path> 00070000|TSU:D0001|0409|MSShared64Folder|\Microsoft Shared 00070000|TSU:D0001|0409|MSSharedFolder|\Microsoft Shared 00070000|TSU:D0001|0409|MutexTimeoutErrorCode|1460 00070000|TSU:D0001|0409|MyExistedStepID" in Source: sample.bin