Advanced File Analysis System

File Name: SimplyWatch_3142637754.exe

File Type: PE32 executable (GUI) Intel 80386, for MS Windows

SHA1: 61adaa1e33defc6220507b83b910c562c63f014c

MD5: 332d9f2a17a88c50be5910c449fb6317

Download Kill Chain Report

Accessed Files

C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Users\user\AppData\Local\Temp\netmsg.dll
C:\Windows\System32\netmsg.dll
C:\Users\user\AppData\Local\Temp\61adaa1e33defc6220507b83b910c562c63f014c.exe
C:\Users\user\AppData\Local\Temp
- C:\Users\user\AppData\Local\Temp\is-0KU8E.tmp
- C:\Users\user\AppData\Local\Temp\is-0KU8E.tmp\61adaa1e33defc6220507b83b910c562c63f014c.tmp
- C:\Windows\Globalization\Sorting\sortdefault.nls
- C:\Windows\Fonts\staticcache.dat
- \Device\KsecDD
- C:\Users\user\AppData\Local\Temp\is-0KU8E.tmp\netmsg.dll
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\_setup64.tmp
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\_shfoldr.dll
- C:\Windows\System32\uxtheme.dll.Config
- C:\Windows\System32\uxtheme.dll
- C:\Users\user\AppData\Local\Temp\is-0KU8E.tmp\61adaa1e33defc6220507b83b910c562c63f014c.tmp.Local\
- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2
- c:\directory
- C:\Windows\System32\imageres.dll
- C:\Windows\System32\shell32.dll
- C:\
- C:\Program Files (x86)\Rigi\
- C:\Program Files (x86)\
- C:\Program Files (x86)\Rigi
- C:\Program Files (x86)\Rigi\Lanutet.exe
- C:\Windows\System32
- C:\Program Files (x86)
- C:\Program Files (x86)\Rigi\unins???.*
- C:\Program Files (x86)\Rigi\unins000.dat
- C:\Windows\winsxs\FileMaps\program_files_x86_rigi_32387ed964e6ec49.cdf-ms
- C:\Program Files (x86)\Rigi\unins000.exe
- C:\Program Files (x86)\Rigi\is-VRTFQ.tmp
- C:\Program Files (x86)\Rigi\Hohonire.wma
- C:\Program Files (x86)\Rigi\is-TB9S0.tmp
- C:\Program Files (x86)\Rigi\Celiditufo.com
- C:\Program Files (x86)\Rigi\is-T45L4.tmp
- C:\Program Files (x86)\Rigi\is-O0E01.tmp
- C:\Program Files (x86)\Rigi\Tatokerulon.pptx
- C:\Program Files (x86)\Rigi\is-92IOP.tmp
- C:\Program Files (x86)\Rigi\Hebuborahabu.ha
- C:\Program Files (x86)\Rigi\is-KVPVP.tmp
- C:\Program Files (x86)\Rigi\Nabonepugak.pebe
- C:\Program Files (x86)\Rigi\is-G1IR4.tmp
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\*
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\*
Show More 42

Read Registry Keys

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\B6C2FB48
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\AutoSuggest
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\Always Use Tab
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\Client\(Default)
- HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\PendingFileRenameOperations
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\PendingFileRenameOperations2
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Sequence
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFiles0000
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFiles0001
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFilesHash
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegSvcs0000
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegProcs0000
- HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\unins000.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Hohonire.wma
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Celiditufo.com
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Lanutet.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Tatokerulon.pptx
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Hebuborahabu.ha
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Nabonepugak.pebe
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\JSCount
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\ESCount
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RRCount
Show More 62

Modified Files

C:\Users\user\AppData\Local\Temp\is-0KU8E.tmp\61adaa1e33defc6220507b83b910c562c63f014c.tmp
C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\_setup64.tmp
C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\_shfoldr.dll
C:\Program Files (x86)\Rigi\Lanutet.exe
C:\Program Files (x86)\Rigi\unins000.dat
- C:\Program Files (x86)\Rigi\is-VRTFQ.tmp
- C:\Program Files (x86)\Rigi\unins000.exe
- C:\Program Files (x86)\Rigi\is-TB9S0.tmp
- C:\Program Files (x86)\Rigi\Hohonire.wma
- C:\Program Files (x86)\Rigi\is-T45L4.tmp
- C:\Program Files (x86)\Rigi\Celiditufo.com
- C:\Program Files (x86)\Rigi\is-O0E01.tmp
- C:\Program Files (x86)\Rigi\is-92IOP.tmp
- C:\Program Files (x86)\Rigi\Tatokerulon.pptx
- C:\Program Files (x86)\Rigi\is-KVPVP.tmp
- C:\Program Files (x86)\Rigi\Hebuborahabu.ha
- C:\Program Files (x86)\Rigi\is-G1IR4.tmp
- C:\Program Files (x86)\Rigi\Nabonepugak.pebe
Show More 13

Resolved APIs

kernel32.dll.SetDllDirectoryW
kernel32.dll.SetSearchPathMode
kernel32.dll.SetProcessDEPPolicy
kernel32.dll.Wow64DisableWow64FsRedirection
kernel32.dll.Wow64RevertWow64FsRedirection
- kernel32.dll.GetUserDefaultUILanguage
- kernel32.dll.AreFileApisANSI
- kernel32.dll.GetCurrentProcessId
- kernel32.dll.GetModuleFileNameW
- kernel32.dll.CreateFileW
- kernel32.dll.VirtualAlloc
- kernel32.dll.LoadLibraryA
- kernel32.dll.VirtualProtect
- kernel32.dll.VirtualFree
- kernel32.dll.FreeLibrary
- kernel32.dll.DeleteCriticalSection
- kernel32.dll.LeaveCriticalSection
- kernel32.dll.EnterCriticalSection
- kernel32.dll.InitializeCriticalSection
- kernel32.dll.LocalFree
- kernel32.dll.LocalAlloc
- kernel32.dll.GetCurrentThreadId
- kernel32.dll.WideCharToMultiByte
- kernel32.dll.lstrlenA
- kernel32.dll.lstrcpynA
- kernel32.dll.LoadLibraryExA
- kernel32.dll.GetThreadLocale
- kernel32.dll.GetStartupInfoA
- kernel32.dll.GetProcAddress
- kernel32.dll.GetModuleHandleA
- kernel32.dll.GetModuleFileNameA
- kernel32.dll.GetLocaleInfoA
- kernel32.dll.GetCommandLineA
- kernel32.dll.FindFirstFileA
- kernel32.dll.FindClose
- kernel32.dll.ExitProcess
- kernel32.dll.WriteFile
- kernel32.dll.UnhandledExceptionFilter
- kernel32.dll.RtlUnwind
- kernel32.dll.RaiseException
- kernel32.dll.GetStdHandle
- user32.dll.GetKeyboardType
- user32.dll.LoadStringA
- user32.dll.MessageBoxA
- user32.dll.CharNextA
- advapi32.dll.RegQueryValueExA
- advapi32.dll.RegOpenKeyExA
- advapi32.dll.RegCloseKey
- oleaut32.dll.SysFreeString
- oleaut32.dll.SysReAllocStringLen
- kernel32.dll.TlsSetValue
- kernel32.dll.TlsGetValue
- kernel32.dll.TlsFree
- kernel32.dll.TlsAlloc
- kernel32.dll.VirtualQueryEx
- kernel32.dll.VirtualQuery
- kernel32.dll.ReadProcessMemory
- kernel32.dll.OpenProcess
- kernel32.dll.MoveFileExA
- kernel32.dll.GetVersionExA
- kernel32.dll.GetTickCount
- kernel32.dll.GetSystemPowerStatus
- kernel32.dll.GetSystemInfo
- kernel32.dll.GetStringTypeExA
- kernel32.dll.GetDiskFreeSpaceA
- kernel32.dll.GetCurrencyFormatW
- kernel32.dll.GetCPInfo
- kernel32.dll.GetACP
- kernel32.dll.FillConsoleOutputCharacterA
- kernel32.dll.EnumCalendarInfoA
- kernel32.dll.CloseHandle
- user32.dll.GetUserObjectInformationA
- user32.dll.GetSystemMetrics
- user32.dll.GetLastInputInfo
- user32.dll.AppendMenuA
- kernel32.dll.GetDiskFreeSpaceExA
- comctl32.dll.RegisterClassNameW
- kernel32.dll.SortGetHandle
- kernel32.dll.SortCloseHandle
- uxtheme.dll.ThemeInitApiHook
- user32.dll.IsProcessDPIAware
- dwmapi.dll.DwmIsCompositionEnabled
- uxtheme.dll.EnableThemeDialogTexture
- gdi32.dll.GetLayout
- gdi32.dll.GdiRealizationInfo
- gdi32.dll.FontIsLinked
- advapi32.dll.RegOpenKeyExW
- advapi32.dll.RegQueryInfoKeyW
- gdi32.dll.GetTextFaceAliasW
- advapi32.dll.RegEnumValueW
- advapi32.dll.RegQueryValueExW
- gdi32.dll.GetFontAssocStatus
- advapi32.dll.RegEnumKeyExW
- gdi32.dll.GdiIsMetaPrintDC
- ole32.dll.CoInitializeEx
- ole32.dll.CoUninitialize
- cryptbase.dll.SystemFunction036
- ole32.dll.CoRegisterInitializeSpy
- ole32.dll.CoRevokeInitializeSpy
- uxtheme.dll.OpenThemeData
- uxtheme.dll.CloseThemeData
- uxtheme.dll.DrawThemeBackground
- uxtheme.dll.DrawThemeText
- uxtheme.dll.GetThemeBackgroundContentRect
- uxtheme.dll.GetThemePartSize
- uxtheme.dll.GetThemeTextExtent
- uxtheme.dll.GetThemeTextMetrics
- uxtheme.dll.GetThemeBackgroundRegion
- uxtheme.dll.HitTestThemeBackground
- uxtheme.dll.DrawThemeEdge
- uxtheme.dll.DrawThemeIcon
- uxtheme.dll.IsThemePartDefined
- uxtheme.dll.IsThemeBackgroundPartiallyTransparent
- uxtheme.dll.GetThemeColor
- uxtheme.dll.GetThemeMetric
- uxtheme.dll.GetThemeString
- uxtheme.dll.GetThemeBool
- uxtheme.dll.GetThemeInt
- uxtheme.dll.GetThemeEnumValue
- uxtheme.dll.GetThemePosition
- uxtheme.dll.GetThemeFont
- uxtheme.dll.GetThemeRect
- uxtheme.dll.GetThemeMargins
- uxtheme.dll.GetThemeIntList
- uxtheme.dll.GetThemePropertyOrigin
- uxtheme.dll.SetWindowTheme
- uxtheme.dll.GetThemeFilename
- uxtheme.dll.GetThemeSysColor
- uxtheme.dll.GetThemeSysColorBrush
- uxtheme.dll.GetThemeSysBool
- uxtheme.dll.GetThemeSysSize
- uxtheme.dll.GetThemeSysFont
- uxtheme.dll.GetThemeSysString
- uxtheme.dll.GetThemeSysInt
- uxtheme.dll.IsThemeActive
- uxtheme.dll.IsAppThemed
- uxtheme.dll.GetWindowTheme
- uxtheme.dll.IsThemeDialogTextureEnabled
- uxtheme.dll.GetThemeAppProperties
- uxtheme.dll.SetThemeAppProperties
- uxtheme.dll.GetCurrentThemeName
- uxtheme.dll.GetThemeDocumentationProperty
- uxtheme.dll.DrawThemeParentBackground
- uxtheme.dll.EnableTheming
- user32.dll.NotifyWinEvent
- shell32.dll.SHCreateItemFromParsingName
- shell32.dll.SHPathPrepareForWriteA
- kernel32.dll.VerSetConditionMask
- kernel32.dll.VerifyVersionInfoW
- kernel32.dll.GetNativeSystemInfo
- kernel32.dll.IsWow64Process
- kernel32.dll.GetSystemWow64DirectoryA
- advapi32.dll.RegDeleteKeyExA
- user32.dll.DisableProcessWindowsGhosting
- advapi32.dll.CheckTokenMembership
- user32.dll.ShutdownBlockReasonDestroy
- user32.dll.ShutdownBlockReasonCreate
- shfolder.dll.SHGetFolderPathA
- rstrtmgr.dll.RmStartSession
- rstrtmgr.dll.RmRegisterResources
- rstrtmgr.dll.RmGetList
- rstrtmgr.dll.RmShutdown
- rstrtmgr.dll.RmRestart
- rstrtmgr.dll.RmEndSession
- bcryptprimitives.dll.GetHashInterface
- comctl32.dll.HIMAGELIST_QueryInterface
- comctl32.dll.DrawShadowText
- comctl32.dll.DrawSizeBox
- comctl32.dll.DrawScrollBar
- comctl32.dll.SizeBoxHwnd
- comctl32.dll.ScrollBar_MouseMove
- comctl32.dll.ScrollBar_Menu
- comctl32.dll.HandleScrollCmd
- comctl32.dll.DetachScrollBars
- comctl32.dll.AttachScrollBars
- comctl32.dll.CCSetScrollInfo
- comctl32.dll.CCGetScrollInfo
- comctl32.dll.CCEnableScrollBar
- comctl32.dll.QuerySystemGestureStatus
- uxtheme.dll.#49
- user32.dll.ChangeWindowMessageFilterEx
- gdi32.dll.GetTextExtentExPointWPri
- imm32.dll.ImmIsIME
- imm32.dll.ImmGetContext
- imm32.dll.ImmReleaseContext
- imm32.dll.ImmAssociateContext
- user32.dll.MonitorFromRect
- user32.dll.GetMonitorInfoA
- shlwapi.dll.SHAutoComplete
- ole32.dll.CoCreateInstance
- comctl32.dll.#411
- comctl32.dll.#410
- ole32.dll.CLSIDFromString
- comctl32.dll.#413
- uxtheme.dll.BufferedPaintInit
- uxtheme.dll.BufferedPaintRenderAnimation
- uxtheme.dll.BeginBufferedAnimation
- uxtheme.dll.EndBufferedAnimation
- uxtheme.dll.DrawThemeParentBackgroundEx
- imm32.dll.ImmLockIMC
- imm32.dll.ImmUnlockIMC
- imm32.dll.ImmSetCompositionFontW
- imm32.dll.ImmGetCompositionWindow
- imm32.dll.ImmSetCompositionWindow
- uxtheme.dll.BeginBufferedPaint
- uxtheme.dll.EndBufferedPaint
- uxtheme.dll.BufferedPaintStopAllAnimations
- sfc.dll.SfcIsFileProtected
- setupapi.dll.PnpIsFilePnpDriver
- kernel32.dll.RegOpenKeyExW
- kernel32.dll.RegCloseKey
- devrtl.dll.DevRtlGetThreadLogToken
- comctl32.dll.#412
- comctl32.dll.#388
- uxtheme.dll.BufferedPaintUnInit
- oleaut32.dll.#500
- comctl32.dll.#321
Show More 212

Deleted Files

C:\Users\user\AppData\Local\Temp\is-0KU8E.tmp\61adaa1e33defc6220507b83b910c562c63f014c.tmp
C:\Users\user\AppData\Local\Temp\is-0KU8E.tmp
C:\Program Files (x86)\Rigi\is-VRTFQ.tmp
C:\Program Files (x86)\Rigi\is-TB9S0.tmp
C:\Program Files (x86)\Rigi\is-T45L4.tmp
- C:\Program Files (x86)\Rigi\is-O0E01.tmp
- C:\Program Files (x86)\Rigi\is-92IOP.tmp
- C:\Program Files (x86)\Rigi\is-KVPVP.tmp
- C:\Program Files (x86)\Rigi\is-G1IR4.tmp
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\_setup64.tmp
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\_shfoldr.dll
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp
Show More 8

Deleted Registry Keys

HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFilesHash
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFiles0000
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Sequence
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\SessionHash
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Owner

Registry Keys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
- HKEY_CURRENT_USER\Software\Borland\Locales
- HKEY_LOCAL_MACHINE\Software\Borland\Locales
- HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000409
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontLink\SystemLink
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\Disable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\DataStore_V1.0\DataFilePath
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane1
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane3
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane4
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane5
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane6
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane7
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane8
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane9
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane10
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane11
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane12
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane13
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane14
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane15
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane16
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Segoe UI
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\61adaa1e33defc6220507b83b910c562c63f014c.tmp
- HKEY_LOCAL_MACHINE\Software\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{0000897b-83df-4b96-be07-0fb58b01c4a4}\LanguageProfile\0x00000000\{0001bea3-ed56-483d-a2e2-aeae25577436}\Enable
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\CTF\EnableAnchorContext
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\KnownClasses
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOwner
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\RegisteredOrganization
- HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\B6C2FB48
- HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Owner
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\SessionHash
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Sequence
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Sans Serif
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Tahoma
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Verdana
- HKEY_LOCAL_MACHINE\Software\Policies
- HKEY_CURRENT_USER\Software\Policies
- HKEY_CURRENT_USER\Software
- HKEY_LOCAL_MACHINE\Software
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\AutoSuggest
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\Always Use Tab
- HKEY_CLASSES_ROOT\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\InProcServer32\(Default)
- HKEY_CLASSES_ROOT\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\InProcServer32\(Default)
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\AutoComplete\Client\(Default)
- HKEY_CURRENT_USER
- HKEY_CURRENT_USER\Control Panel\Desktop
- HKEY_CURRENT_USER\Control Panel\Desktop\SmoothScroll
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\EnableBalloonTips
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewAlphaSelect
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ListviewShadow
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\PendingFileRenameOperations
- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\PendingFileRenameOperations2
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFiles0000
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFilesHash
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFiles0001
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegSvcs0000
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegProcs0000
- HKEY_LOCAL_MACHINE\System\Setup
- HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
- HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\PnpLockdownFiles
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\unins000.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Hohonire.wma
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Celiditufo.com
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Lanutet.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Tatokerulon.pptx
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Hebuborahabu.ha
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\PnpLockdownFiles\%SystemDrive%\Program Files (x86)\Rigi\Nabonepugak.pebe
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: Setup Version
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: App Path
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\InstallLocation
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: Icon Group
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: User
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: Language
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\DisplayName
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\UninstallString
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\QuietUninstallString
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\DisplayVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\NoModify
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\NoRepair
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\InstallDate
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\MajorVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\MinorVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\EstimatedSize
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\JSCount
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\ESCount
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RRCount
Show More 131

Read Files

C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\System32\netmsg.dll
C:\Users\user\AppData\Local\Temp\61adaa1e33defc6220507b83b910c562c63f014c.exe
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Windows\Fonts\staticcache.dat
- \Device\KsecDD
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\_setup64.tmp
- C:\Users\user\AppData\Local\Temp\is-JC7D7.tmp\_isetup\_shfoldr.dll
- C:\Windows\System32\uxtheme.dll.Config
- C:\Windows\System32\uxtheme.dll
- C:\Windows\System32\imageres.dll
- C:\Windows\System32\shell32.dll
- C:\
- C:\Program Files (x86)\Rigi\Lanutet.exe
- C:\Program Files (x86)\Rigi\unins000.dat
- C:\Windows\winsxs\FileMaps\program_files_x86_rigi_32387ed964e6ec49.cdf-ms
- C:\Program Files (x86)\Rigi\is-VRTFQ.tmp
- C:\Users\user\AppData\Local\Temp\is-0KU8E.tmp\61adaa1e33defc6220507b83b910c562c63f014c.tmp
- C:\Program Files (x86)\Rigi\is-TB9S0.tmp
- C:\Program Files (x86)\Rigi\is-T45L4.tmp
- C:\Program Files (x86)\Rigi\is-O0E01.tmp
- C:\Program Files (x86)\Rigi\is-92IOP.tmp
- C:\Program Files (x86)\Rigi\is-KVPVP.tmp
- C:\Program Files (x86)\Rigi\is-G1IR4.tmp
Show More 19

Mutexes

CicLoadWinStaWinSta0
Local\MSCTF.CtfMonitorInstMutexDefault1
Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
DefaultTabtip-MainUI

Modified Registry Keys

HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Owner
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\SessionHash
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Sequence
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFiles0000
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\RegFilesHash
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: Setup Version
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: App Path
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\InstallLocation
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: Icon Group
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: User
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\Inno Setup: Language
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\DisplayName
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\UninstallString
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\QuietUninstallString
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\DisplayVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\NoModify
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\NoRepair
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\InstallDate
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\MajorVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\MinorVersion
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Rigi_is1\EstimatedSize
Show More 18

Loading...