[snovvman]

It is amazing how many things happen with the registry inside of 30 seconds.

I started 1) File Manager, navigated to express.cab directory,
2) Switched task to launch RegLogger, enabled capture,
3) Switch task to File Manager, lanuch express.cab, wait for "previous version will be uninstalled" dialog
4) Switch task to RegLogger, end capture, save text file.

I did this to minimize the registry activity, but still resulted in over 700K worth of data.

I've begun weeding through it, but have not yet seen anything obvious. There is a lot of certificate entries, but I have yet seen evidence of express looking into a registry for a specificy key or item.

Registry txt file attached below.

Thanks.