"SOFTWARE\Microsoft\Ole" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: sample.bin, "SetupDiag.exe /Output:C:\SetupDiag\Results.txt /LogsPath:D:\Temp\Logs\Logs1 /RegPath:HKEY_CURRENT_USER\SYSTEM\SetupDiag" in Source: sample.bin, "hku\" in Source: sample.bin, "uninstall))\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\sInfo\s+MOUPG\s+SetupHost::Initialize:\sCmdLine\s+=\s\[/(?.+)\s/RollbackSys)\]\]> (?\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2}),\s+Info\s+MOUPG\s+CInstallUI::ShowRollbackPage)\]\]> \s+Info\s+SP\s+Antivirus\ssoftware\sinformation:\r\n\s+Name:\s(?[\w\s]+),)\]\]> \s+New\sfilter\sdriver\sName:\s(?\w+),)\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [^\.]{16})\]\]> [0-9a-fA-Z" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: sample.bin, "hklm\" in Source: sample.bin, "hkcu\" in Source: sample.bin, "> failed\sto\sextract\sfile\sfrom\sreference\sextension\]\s(?.+)\s\(Error\s=\s(?[\d]+)\))\]\]> Error\s+SP\s+Operation\sfailed:\sApply\sWIM\sfile\sPathForNewOSFile(?:\s\(compact\))?,\sindex\s[\d]+\sto\s(?.+)\sError:\s(?0x\w{8}))\]\]>