IOC Report
thunderbird-to-outlook-converter.exe

loading gif

Files

File Path
Type
Category
Malicious
thunderbird-to-outlook-converter.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.DLL
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Config.Msi\5d34b8.rbs
data
modified
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Aspose.Email.DLL
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\License Agreement.rtf
Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
dropped
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\Mailsdaddy Thunderbird To Outlook Converter.lnk
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
dropped
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\MailsdaddyThunderbirdToOutlookConverter.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\TreeksLicensingLibrary2.tlb
data
dropped
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\header.jpg
JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=4], baseline, precision 8, 497x69, components 3
dropped
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\mailsdaddy.ico
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Local\Temp\CFG3728.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\CFGF8C8.tmp
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\MSIF618.tmp
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {A232982E-298B-41EA-93F1-4F055FADF244}, Title: MailsDaddy Thunderbird to Outlook Converter, Author: MailsDaddy Software (P) Ltd., Number of Words: 2, Last Saved Time/Date: Wed Oct 7 08:41:05 2020, Last Printed: Wed Oct 7 08:41:05 2020
dropped
C:\Users\user\AppData\Local\Temp\MSIF85A.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\MSIF8D8.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_039DBA7754DFCAABD648C2.exe
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_1ABCAD378361F678050DB6.exe
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_59A44D4F4928D847AB3E43.exe
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\_853F67D554F05449430E7E.exe
MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MailsDaddy\Mailsdaddy Thunderbird To Outlook Converter.lnk
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
dropped
C:\Users\user\Desktop\Mailsdaddy Thunderbird To Outlook Converter.lnk
MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
dropped
C:\Windows\Installer\5d34b7.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {A232982E-298B-41EA-93F1-4F055FADF244}, Title: MailsDaddy Thunderbird to Outlook Converter, Author: MailsDaddy Software (P) Ltd., Number of Words: 2, Last Saved Time/Date: Wed Oct 7 08:41:05 2020, Last Printed: Wed Oct 7 08:41:05 2020
dropped
C:\Windows\Installer\5d34b9.msi
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {A232982E-298B-41EA-93F1-4F055FADF244}, Title: MailsDaddy Thunderbird to Outlook Converter, Author: MailsDaddy Software (P) Ltd., Number of Words: 2, Last Saved Time/Date: Wed Oct 7 08:41:05 2020, Last Printed: Wed Oct 7 08:41:05 2020
dropped
C:\Windows\Installer\MSI36CB.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI3739.tmp
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Windows\Installer\MSI37A7.tmp
data
dropped
C:\Windows\Installer\SourceHash{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Installer\inprogressinstallinfo.ipi
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
dropped
C:\Windows\Temp\~DF024FF338AFB7C580.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DF05E92B92D98D84B0.TMP
data
dropped
C:\Windows\Temp\~DF1B4961396F494972.TMP
data
dropped
C:\Windows\Temp\~DF398311AC0ED6BE97.TMP
data
dropped
C:\Windows\Temp\~DF425128921A3C3CF1.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DF6F331D9E6A1A4B55.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DF733F5D7A6A2BFFF0.TMP
data
dropped
C:\Windows\Temp\~DF74B0A4B7829CD6FD.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DF9AFC030D0E740FB6.TMP
data
dropped
C:\Windows\Temp\~DFB53C683215404C64.TMP
Composite Document File V2 Document, Cannot read section info
dropped
C:\Windows\Temp\~DFD094D166183BA70A.TMP
data
dropped
C:\Windows\Temp\~DFD3B2D85F736F5F4F.TMP
data
dropped
There are 31 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe
"C:\Users\user\Desktop\thunderbird-to-outlook-converter.exe"
C:\Windows\SysWOW64\msiexec.exe
msiexec.exe /i C:\Users\user\AppData\Local\Temp\MSIF618.tmp
C:\Windows\System32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
C:\Windows\SysWOW64\msiexec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7290A6845925C195E7014D9F7E4EB858 C
C:\Windows\SysWOW64\msiexec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding C3F8760112445D68E9871B76E5B0FA05

URLs

Name
IP
Malicious
http://crl.godaddy.com/gdroot-g2.crl0F
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
http://ocsp.starfieldtech.com/0H
unknown
http://crl.starfieldtech.com/repository/0
unknown
http://crl.starfieldtech.com/repository/masterstarfield2issuing.crl0P
unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0
unknown
http://ocsp.sectigo.com0
unknown
https://certs.starfieldtech.com/repository/0
unknown
http://certificates.godaddy.com/repository/0
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
http://certs.starfieldtech.com/repository/1402
unknown
http://crl.starfieldtech.com/sfroot-g2.crl0L
unknown
http://ocsp.thawte.com0
unknown
http://certs.godaddy.com/repository/1301
unknown
https://sectigo.com/CPS0D
unknown
http://crl.godaddy.com/gdig2s5-5.crl0
unknown
http://crl.starfieldtech.com/repository/sf_issuing_ca-g2.crt0T
unknown
http://ocsp.starfieldtech.com/0;
unknown
https://certs.godaddy.com/repository/0
unknown
http://certificates.godaddy.com/repository/gdig2.crt0
unknown
https://purchase.aspose.com/policies/use-license
unknown
There are 11 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer
GlobalAssocChangedCounter
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Owner
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
SessionHash
HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Sequence
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Config.Msi\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\5d34b8.rbs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
C:\Config.Msi\5d34b8.rbsLow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Users\user\AppData\Roaming\Microsoft\Installer\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\5363F89D6A5E796EA8AEFFA98569D325
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\1DF7328D81ED1CD5E09C53435764BB7F
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\88F65860310FEFCF9BE8DF3EFFB5C66A
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\610BB523B41F3BDF4CBF0A8F30B59B8B
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\8AEA6271766C0A06944C3301D0DC4AB5
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\7B5B9FB532BEA16685249A866194FCDC
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\3A5A991E697782D075171E1653858136
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Components\B34F14A7ABB62C143920B0DDBECB30C8
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\MailsDaddy Thunderbird to Outlook Converter\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Program Files (x86)\MailsDaddy Software (P) Ltd\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Users\user\AppData\Roaming\Microsoft\Installer\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MailsDaddy\
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\ProxyStubClsid32
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\TypeLib
Version
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\TypeLib
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{84DEFC49-5297-3423-ADF7-52320A390A75}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{84DEFC49-5297-3423-ADF7-52320A390A75}\ProxyStubClsid32
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{30C8ECB4-8CB4-35F1-A502-2D1F80F6BBEF}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{D20FA2F4-58F6-3703-A3C0-4AE5A4837418}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{D20FA2F4-58F6-3703-A3C0-4AE5A4837418}\ProxyStubClsid32
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}\TypeLib
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}\TypeLib
Version
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{38A19143-BD86-3979-870A-73C9A265C68B}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{38A19143-BD86-3979-870A-73C9A265C68B}\ProxyStubClsid32
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{38A19143-BD86-3979-870A-73C9A265C68B}\TypeLib
Version
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{38A19143-BD86-3979-870A-73C9A265C68B}\TypeLib
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}\TypeLib
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}\TypeLib
Version
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}\ProxyStubClsid32
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{4A4D158B-070F-354D-A0F5-0BCE5C7AEA61}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{5D62DB04-1AB7-32A0-99EB-7BC46A8D95C6}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}\ProxyStubClsid32
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}\TypeLib
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}\TypeLib
Version
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7514227A-923F-32A3-8A23-07B6900B39E8}
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{7514227A-923F-32A3-8A23-07B6900B39E8}\ProxyStubClsid32
NULL
HKEY_CURRENT_USER_Classes\WOW6432Node\Interface\{FA8FD228-DC71-39EE-9DF3-7B6C0C9547F6}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
LocalPackage
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
AuthorizedCDFPrefix
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
Comments
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
Contact
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
DisplayVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
HelpLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
HelpTelephone
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
InstallDate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
InstallLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
InstallSource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
ModifyPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
Readme
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
Size
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
EstimatedSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
UninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
URLInfoAbout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
URLUpdateInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
VersionMajor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
VersionMinor
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
WindowsInstaller
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
Language
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
AuthorizedCDFPrefix
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
Comments
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
Contact
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
DisplayVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
HelpLink
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
HelpTelephone
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
InstallDate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
InstallLocation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
InstallSource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
ModifyPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
Publisher
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
Readme
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
Size
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
EstimatedSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
UninstallString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
URLInfoAbout
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
URLUpdateInfo
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
VersionMajor
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
VersionMinor
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
WindowsInstaller
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
Version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
Language
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\E05D73B9DAC9B1846BDA37D88A7154AC
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\InstallProperties
DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{7A41F43B-6BBA-41C2-9302-0BDDEBBC038C}
DisplayName
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Assemblies\C:|Program Files (x86)|MailsDaddy Software (P) Ltd|MailsDaddy Thunderbird to Outlook Converter|TreeksLicensingLibrary2.DLL
TreeksLicensingLibrary2,Version="2.1.6973.5242",Culture="neutral",PublicKeyToken="61021F367F304CC6",ProcessorArchitecture="MSIL"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Assemblies\C:|Program Files (x86)|MailsDaddy Software (P) Ltd|MailsDaddy Thunderbird to Outlook Converter|Aspose.Email.DLL
Aspose.Email,Version="20.2.0.0",Culture="neutral",PublicKeyToken="716FCC553A201E56",ProcessorArchitecture="MSIL"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Assemblies\C:|Program Files (x86)|MailsDaddy Software (P) Ltd|MailsDaddy Thunderbird to Outlook Converter|MailsdaddyThunderbirdToOutlookConverter.exe
MailsdaddyThunderbirdToOutlookConverter,Version="1.0.0.0",Culture="neutral",ProcessorArchitecture="MSIL"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Features\B34F14A7ABB62C143920B0DDBECB30C8
DefaultFeature
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\Features
DefaultFeature
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-2246122658-3693405117-2476756634-1002\Products\B34F14A7ABB62C143920B0DDBECB30C8\Patches
AllPatches
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
ProductName
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
PackageCode
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
Language
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
Version
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
Assignment
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
AdvertiseFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
ProductIcon
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
InstanceType
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
AuthorizedLUAApp
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
DeploymentFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\UpgradeCodes\E05D73B9DAC9B1846BDA37D88A7154AC
B34F14A7ABB62C143920B0DDBECB30C8
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8\SourceList
PackageName
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8\SourceList\Net
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8\SourceList\Media
1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8
Clients
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Installer\Products\B34F14A7ABB62C143920B0DDBECB30C8\SourceList
LastUsedSource
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A11AF88-A7AB-402B-8DC6-256E0509ACD5}\2.1
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A11AF88-A7AB-402B-8DC6-256E0509ACD5}\2.1\FLAGS
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A11AF88-A7AB-402B-8DC6-256E0509ACD5}\2.1\0\win32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{6A11AF88-A7AB-402B-8DC6-256E0509ACD5}\2.1\HELPDIR
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3EB398CE-0061-37EA-B40D-23549420699A}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5AF5A45-63ED-34FF-A517-996E6F7B45C8}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ED338066-746D-3B78-B745-675D9EE2C01A}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA6775AA-0608-3291-97DA-9E384FCBCFA7}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F1EE2780-E88D-3D98-B900-B80C8F72414F}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D20FA2F4-58F6-3703-A3C0-4AE5A4837418}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D20FA2F4-58F6-3703-A3C0-4AE5A4837418}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D20FA2F4-58F6-3703-A3C0-4AE5A4837418}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D20FA2F4-58F6-3703-A3C0-4AE5A4837418}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38A19143-BD86-3979-870A-73C9A265C68B}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{38A19143-BD86-3979-870A-73C9A265C68B}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38A19143-BD86-3979-870A-73C9A265C68B}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{38A19143-BD86-3979-870A-73C9A265C68B}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA8FD228-DC71-39EE-9DF3-7B6C0C9547F6}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FA8FD228-DC71-39EE-9DF3-7B6C0C9547F6}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA8FD228-DC71-39EE-9DF3-7B6C0C9547F6}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA8FD228-DC71-39EE-9DF3-7B6C0C9547F6}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA8FD228-DC71-39EE-9DF3-7B6C0C9547F6}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{84DEFC49-5297-3423-ADF7-52320A390A75}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84DEFC49-5297-3423-ADF7-52320A390A75}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D62DB04-1AB7-32A0-99EB-7BC46A8D95C6}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D62DB04-1AB7-32A0-99EB-7BC46A8D95C6}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5D62DB04-1AB7-32A0-99EB-7BC46A8D95C6}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D62DB04-1AB7-32A0-99EB-7BC46A8D95C6}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5D62DB04-1AB7-32A0-99EB-7BC46A8D95C6}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30C8ECB4-8CB4-35F1-A502-2D1F80F6BBEF}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30C8ECB4-8CB4-35F1-A502-2D1F80F6BBEF}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30C8ECB4-8CB4-35F1-A502-2D1F80F6BBEF}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{30C8ECB4-8CB4-35F1-A502-2D1F80F6BBEF}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{30C8ECB4-8CB4-35F1-A502-2D1F80F6BBEF}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3E40550F-ABA6-3683-A841-27F0A63BBFD9}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}\TypeLib
Version
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3B39494D-677E-3D84-9F1E-26D4D56AD243}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A4D158B-070F-354D-A0F5-0BCE5C7AEA61}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A4D158B-070F-354D-A0F5-0BCE5C7AEA61}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4A4D158B-070F-354D-A0F5-0BCE5C7AEA61}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7514227A-923F-32A3-8A23-07B6900B39E8}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7514227A-923F-32A3-8A23-07B6900B39E8}\ProxyStubClsid32
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7514227A-923F-32A3-8A23-07B6900B39E8}
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7514227A-923F-32A3-8A23-07B6900B39E8}\TypeLib
NULL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7514227A-923F-32A3-8A23-07B6900B39E8}\TypeLib
Version
There are 201 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
unkown
page readonly
28F0000
heap
page read and write
D30000
heap
page read and write
4A8000
unkown
page readonly
D5A000
heap
page read and write
412000
unkown
page readonly
4A8000
unkown
page readonly
412000
unkown
page readonly
40C000
unkown
page readonly
401000
unkown
page execute read
40F000
unkown
page read and write
40F000
unkown
page write copy
D76000
heap
page read and write
111F000
stack
page read and write
D50000
heap
page read and write
4A8000
unkown
page readonly
4BC000
unkown
page readonly
C9E000
stack
page read and write
C40000
heap
page read and write
400000
unkown
page readonly
40C000
unkown
page readonly
412000
unkown
page readonly
C50000
heap
page read and write
401000
unkown
page execute read
D5E000
heap
page read and write
2A3D000
stack
page read and write
101F000
stack
page read and write
9A000
stack
page read and write
D20000
heap
page read and write
19D000
stack
page read and write
CDE000
stack
page read and write
293C000
stack
page read and write
4BC000
unkown
page readonly
D79000
heap
page read and write
4BC000
unkown
page readonly
D00000
heap
page read and write
There are 26 hidden memdumps, click here to show them.