Analysis Details
Category Package Started Completed Duration Options Logs
URL edge 2026-05-28 21:11:50 2026-05-28 21:15:19 209s
Reports JSON
Options
interactive=1
nohuman=yes
vnc_port=5910
Analysis Log
2026-05-28 20:55:31,076 [root] INFO: Date set to: 20260528T21:11:57, timeout set to: 200
2026-05-28 21:11:57,015 [root] DEBUG: Starting analyzer from: C:\lpw_albt
2026-05-28 21:11:57,015 [root] DEBUG: Storing results at: C:\EsskdWmsyS
2026-05-28 21:11:57,016 [root] DEBUG: Pipe server name: \\.\PIPE\HICbhmaojK
2026-05-28 21:11:57,017 [root] DEBUG: Python path: C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64
2026-05-28 21:11:57,019 [root] INFO: analysis running as an admin
2026-05-28 21:11:57,019 [root] INFO: analysis package specified: "edge"
2026-05-28 21:11:57,019 [root] DEBUG: importing analysis package module: "modules.packages.edge"...
2026-05-28 21:11:57,023 [root] DEBUG: imported analysis package "edge"
2026-05-28 21:11:57,024 [root] DEBUG: initializing analysis package "edge"...
2026-05-28 21:11:57,024 [root] DEBUG: New location of moved file: r
2026-05-28 21:11:57,024 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option
2026-05-28 21:11:57,024 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option
2026-05-28 21:11:57,025 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option
2026-05-28 21:11:57,025 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option
2026-05-28 21:11:57,048 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-05-28 21:11:57,065 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-05-28 21:11:57,075 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-05-28 21:11:57,084 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-05-28 21:11:57,088 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-05-28 21:11:57,088 [lib.api.screenshot] ERROR: No module named 'PIL'
2026-05-28 21:11:57,089 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-05-28 21:11:57,090 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-05-28 21:11:57,090 [root] DEBUG: Initialized auxiliary module "Browser"
2026-05-28 21:11:57,090 [root] DEBUG: attempting to configure 'Browser' from data
2026-05-28 21:11:57,091 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-05-28 21:11:57,091 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-05-28 21:11:57,092 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-05-28 21:11:57,092 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-05-28 21:11:57,094 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-05-28 21:11:57,095 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-05-28 21:11:57,096 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-05-28 21:11:57,096 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file
2026-05-28 21:11:57,096 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-05-28 21:11:57,097 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-05-28 21:11:57,097 [root] DEBUG: attempting to configure 'Disguise' from data
2026-05-28 21:11:57,098 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-05-28 21:11:57,098 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-05-28 21:11:57,101 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 8896)
2026-05-28 21:11:57,103 [modules.auxiliary.disguise] INFO: Disguising GUID to 80438ff8-63a5-4e06-b69a-a7d9e7479144
2026-05-28 21:11:57,104 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-05-28 21:11:57,104 [root] DEBUG: Initialized auxiliary module "Human"
2026-05-28 21:11:57,104 [root] DEBUG: attempting to configure 'Human' from data
2026-05-28 21:11:57,104 [root] DEBUG: module Human does not support data configuration, ignoring
2026-05-28 21:11:57,105 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-05-28 21:11:57,105 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-05-28 21:11:57,106 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-05-28 21:11:57,106 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-05-28 21:11:57,107 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-05-28 21:11:57,107 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-05-28 21:11:57,107 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled
2026-05-28 21:11:57,107 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-05-28 21:11:57,108 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-05-28 21:11:57,108 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-05-28 21:11:57,108 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-05-28 21:11:57,108 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-05-28 21:11:57,110 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process
2026-05-28 21:11:57,111 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-05-28 21:11:57,111 [root] INFO: Interactive mode enabled - injecting into explorer shell
2026-05-28 21:11:57,188 [lib.api.process] INFO: Monitor config for process 4484: C:\lpw_albt\dll\4484.ini
2026-05-28 21:11:57,189 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:11:57,192 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:11:57,236 [root] DEBUG: Loader: Injecting process 4484 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:11:57,393 [root] DEBUG: 4484: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:11:57,394 [root] DEBUG: 4484: Disabling sleep skipping.
2026-05-28 21:11:57,394 [root] DEBUG: 4484: Interactive desktop enabled.
2026-05-28 21:11:57,395 [root] DEBUG: 4484: Dropped file limit defaulting to 100.
2026-05-28 21:11:57,395 [root] DEBUG: 4484: Interactive desktop - injecting Explorer Shell
2026-05-28 21:11:57,401 [root] DEBUG: 4484: YaraInit: Compiled 44 rule files
2026-05-28 21:11:57,407 [root] DEBUG: 4484: YaraInit: Compiled rules saved to file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:11:57,429 [root] DEBUG: 4484: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:11:57,430 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316
2026-05-28 21:11:57,488 [root] DEBUG: 4484: Monitor initialised: 64-bit capemon loaded in process 4484 at 0x00007FFF18240000, thread 3124, image base 0x00007FF79BC10000, stack from 0x0000000009001000-0x0000000009010000
2026-05-28 21:11:57,489 [root] DEBUG: 4484: Commandline: C:\Windows\Explorer.EXE
2026-05-28 21:11:57,500 [root] DEBUG: 4484: Hooked 69 out of 69 functions
2026-05-28 21:11:57,529 [root] DEBUG: 4484: Syscall hook installed, syscall logging level 1
2026-05-28 21:11:57,536 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 21:11:57,537 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:11:57,540 [lib.api.process] INFO: Injected into 64-bit <Process 4484 explorer.exe>
2026-05-28 21:12:01,484 [root] DEBUG: 4484: caller_dispatch: Added region at 0x00007FF79BC10000 to tracked regions list (user32::SetWindowLongPtrW returns to 0x00007FF79BE75E31, thread 4696).
2026-05-28 21:12:01,486 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316
2026-05-28 21:12:01,526 [root] DEBUG: 4484: ProcessImageBase: Main module image at 0x00007FF79BC10000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:12:04,624 [root] INFO: Restarting WMI Service
2026-05-28 21:12:04,786 [root] DEBUG: 4484: CreateProcessHandler: Injection info set for new process 5312: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:04,788 [root] INFO: Announced 64-bit process name: chrome.exe pid: 5312
2026-05-28 21:12:04,789 [lib.api.process] INFO: Monitor config for process 5312: C:\lpw_albt\dll\5312.ini
2026-05-28 21:12:04,790 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:04,791 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:04,796 [root] DEBUG: Loader: Injecting process 5312 (thread 428) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:04,799 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:04,799 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:04,801 [lib.api.process] INFO: Injected into 64-bit <Process 5312 chrome.exe>
2026-05-28 21:12:04,804 [root] INFO: Announced 64-bit process name: chrome.exe pid: 5312
2026-05-28 21:12:04,804 [lib.api.process] INFO: Monitor config for process 5312: C:\lpw_albt\dll\5312.ini
2026-05-28 21:12:04,805 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:04,806 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:04,810 [root] DEBUG: Loader: Injecting process 5312 (thread 428) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:04,810 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:12:04,811 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:04,812 [lib.api.process] INFO: Injected into 64-bit <Process 5312 chrome.exe>
2026-05-28 21:12:04,816 [root] DEBUG: 4484: DLL loaded at 0x00007FFF47720000: C:\Windows\SYSTEM32\MPR (0x1d000 bytes).
2026-05-28 21:12:04,816 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3D4A0000: C:\Windows\SYSTEM32\pcacli (0x16000 bytes).
2026-05-28 21:12:04,817 [root] DEBUG: 4484: DLL loaded at 0x00007FFF453F0000: C:\Windows\System32\sfc_os (0x12000 bytes).
2026-05-28 21:12:04,845 [root] DEBUG: 5312: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:04,846 [root] DEBUG: 5312: Interactive desktop enabled.
2026-05-28 21:12:04,846 [root] DEBUG: 5312: Dropped file limit defaulting to 100.
2026-05-28 21:12:04,856 [root] DEBUG: 5312: Chrome-specific hook-set enabled.
2026-05-28 21:12:04,858 [root] DEBUG: 5312: Disabling sleep skipping.
2026-05-28 21:12:04,859 [root] DEBUG: 5312: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:04,870 [root] DEBUG: 5312: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:04,870 [root] DEBUG: 5312: Monitor initialised: 64-bit capemon loaded in process 5312 at 0x00007FFF18240000, thread 428, image base 0x00007FF7AD300000, stack from 0x0000007667BF4000-0x0000007667C00000
2026-05-28 21:12:04,871 [root] DEBUG: 5312: Commandline: "C:\Program Files\Google\Chrome\Application\chrome.exe"
2026-05-28 21:12:04,879 [root] DEBUG: 5312: Hooked 2 out of 2 functions
2026-05-28 21:12:04,908 [root] DEBUG: 5312: Syscall hook installed, syscall logging level 1
2026-05-28 21:12:04,914 [root] DEBUG: 5312: RestoreHeaders: Restored original import table.
2026-05-28 21:12:04,915 [root] INFO: Loaded monitor into process with pid 5312
2026-05-28 21:12:04,918 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 21:12:04,938 [root] DEBUG: 5312: InstrumentationCallback: Added region at 0x00007FFF17D90014 (base 0x00007FFF17AE0000) to tracked regions list (thread 428).
2026-05-28 21:12:04,940 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:04,940 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56770000: C:\Windows\system32\ntmarta (0x33000 bytes).
2026-05-28 21:12:04,944 [root] DEBUG: 5312: caller_dispatch: Added region at 0x00007FF7AD300000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7AD3372AF, thread 428).
2026-05-28 21:12:04,947 [root] DEBUG: 5312: ProcessImageBase: Main module image at 0x00007FF7AD300000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:12:04,951 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.262946e+00 (from 6.262770e+00)
2026-05-28 21:12:04,952 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:04,956 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.262946e+00 (from 6.262770e+00)
2026-05-28 21:12:04,956 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:04,957 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 21:12:04,957 [root] DEBUG: 5312: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 21:12:04,962 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.262946e+00 (from 6.262770e+00)
2026-05-28 21:12:04,963 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:04,963 [root] DEBUG: 5312: CreateProcessHandler: Injection info set for new process 8776: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:04,964 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 8776
2026-05-28 21:12:04,968 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.262946e+00 (from 6.262770e+00)
2026-05-28 21:12:04,968 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:04,969 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 8776
2026-05-28 21:12:05,022 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263185e+00 (from 6.262770e+00)
2026-05-28 21:12:05,023 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,304 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263185e+00 (from 6.262770e+00)
2026-05-28 21:12:05,305 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,317 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263185e+00 (from 6.262770e+00)
2026-05-28 21:12:05,317 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,323 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263184e+00 (from 6.262770e+00)
2026-05-28 21:12:05,324 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,330 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263185e+00 (from 6.262770e+00)
2026-05-28 21:12:05,330 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,331 [root] DEBUG: 5312: DLL loaded at 0x00007FFF453C0000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-28 21:12:05,331 [root] DEBUG: 5312: DLL loaded at 0x00007FFF49A90000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-28 21:12:05,332 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57350000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-28 21:12:05,332 [root] DEBUG: 5312: DLL loaded at 0x00007FFF00C20000: C:\Program Files\Google\Chrome\Application\148.0.7778.217\chrome (0x10fdc000 bytes).
2026-05-28 21:12:05,344 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263184e+00 (from 6.262770e+00)
2026-05-28 21:12:05,344 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,349 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263184e+00 (from 6.262770e+00)
2026-05-28 21:12:05,350 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,351 [root] DEBUG: 5312: DLL loaded at 0x00007FFF45010000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-28 21:12:05,364 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263188e+00 (from 6.262770e+00)
2026-05-28 21:12:05,367 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,372 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263188e+00 (from 6.262770e+00)
2026-05-28 21:12:05,372 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,373 [root] DEBUG: 5312: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:12:05,381 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263187e+00 (from 6.262770e+00)
2026-05-28 21:12:05,381 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,382 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57520000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-28 21:12:05,386 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263187e+00 (from 6.262770e+00)
2026-05-28 21:12:05,386 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,387 [root] DEBUG: 5312: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 21:12:05,391 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263188e+00 (from 6.262770e+00)
2026-05-28 21:12:05,391 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,392 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-28 21:12:05,397 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263187e+00 (from 6.262770e+00)
2026-05-28 21:12:05,397 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,398 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-28 21:12:05,410 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263187e+00 (from 6.262770e+00)
2026-05-28 21:12:05,411 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,415 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263187e+00 (from 6.262770e+00)
2026-05-28 21:12:05,416 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,416 [root] DEBUG: 5312: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\netapi32 (0x19000 bytes).
2026-05-28 21:12:05,421 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263187e+00 (from 6.262770e+00)
2026-05-28 21:12:05,421 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,425 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263187e+00 (from 6.262770e+00)
2026-05-28 21:12:05,426 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,430 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,430 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,431 [root] DEBUG: 5312: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:05,431 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-28 21:12:05,433 [root] DEBUG: 5312: DLL loaded at 0x00007FFF52F20000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 21:12:05,438 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263159e+00 (from 6.262770e+00)
2026-05-28 21:12:05,438 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,438 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57560000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-28 21:12:05,446 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263159e+00 (from 6.262770e+00)
2026-05-28 21:12:05,447 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,451 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263159e+00 (from 6.262770e+00)
2026-05-28 21:12:05,452 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,456 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263159e+00 (from 6.262770e+00)
2026-05-28 21:12:05,456 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,462 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263159e+00 (from 6.262770e+00)
2026-05-28 21:12:05,464 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,470 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,470 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,470 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,471 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,471 [root] DEBUG: 5312: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 21:12:05,472 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,472 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,473 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,473 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,475 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,476 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,477 [root] DEBUG: 5312: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:12:05,481 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,482 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,482 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:12:05,486 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,487 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,487 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:12:05,492 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,492 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,493 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263158e+00 (from 6.262770e+00)
2026-05-28 21:12:05,493 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,496 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263159e+00 (from 6.262770e+00)
2026-05-28 21:12:05,497 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,497 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263159e+00 (from 6.262770e+00)
2026-05-28 21:12:05,497 [root] DEBUG: 5312: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:05,498 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,498 [root] DEBUG: 5312: DLL loaded at 0x00007FFF4D340000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-28 21:12:05,502 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,502 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,503 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,503 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,507 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,508 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,508 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,509 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,513 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,513 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,517 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,518 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,522 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,523 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,527 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,527 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,528 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 21:12:05,529 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57010000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 21:12:05,529 [root] DEBUG: 5312: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:12:05,529 [root] DEBUG: 5312: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 21:12:05,530 [root] DEBUG: 5312: DLL loaded at 0x00007FFF15300000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-28 21:12:05,530 [root] DEBUG: 5312: DLL loaded at 0x00007FFF4D300000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-28 21:12:05,534 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,535 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,535 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56FD0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 21:12:05,541 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,542 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,542 [root] DEBUG: 5312: DLL loaded at 0x00007FFF44D50000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-28 21:12:05,546 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,547 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,551 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,552 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,553 [root] DEBUG: 5312: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\netapi32 (0x19000 bytes).
2026-05-28 21:12:05,557 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263160e+00 (from 6.262770e+00)
2026-05-28 21:12:05,558 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,562 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263160e+00 (from 6.262770e+00)
2026-05-28 21:12:05,562 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,562 [root] DEBUG: 5312: DLL loaded at 0x00007FFF569F0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-28 21:12:05,563 [root] DEBUG: 5312: DLL loaded at 0x00007FFF52960000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-28 21:12:05,567 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263160e+00 (from 6.262770e+00)
2026-05-28 21:12:05,567 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,568 [root] DEBUG: 5312: DLL loaded at 0x00007FFF48330000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-28 21:12:05,573 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263161e+00 (from 6.262770e+00)
2026-05-28 21:12:05,574 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,574 [root] DEBUG: 5312: DLL loaded at 0x00007FFF58B20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 21:12:05,578 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263160e+00 (from 6.262770e+00)
2026-05-28 21:12:05,579 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,579 [root] DEBUG: 5312: DLL loaded at 0x00007FFF515C0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 21:12:05,583 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263165e+00 (from 6.262770e+00)
2026-05-28 21:12:05,585 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,585 [root] DEBUG: 5312: DLL loaded at 0x00007FFF515A0000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 21:12:05,590 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263165e+00 (from 6.262770e+00)
2026-05-28 21:12:05,590 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,591 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56A40000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 21:12:05,596 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263166e+00 (from 6.262770e+00)
2026-05-28 21:12:05,596 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,600 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263166e+00 (from 6.262770e+00)
2026-05-28 21:12:05,601 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,605 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263166e+00 (from 6.262770e+00)
2026-05-28 21:12:05,605 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,610 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,610 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,614 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,614 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,616 [root] DEBUG: 5312: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:12:05,620 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,621 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,625 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,625 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,631 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,632 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,636 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,637 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,641 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,641 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,645 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,645 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,646 [root] DEBUG: 5312: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 21:12:05,647 [root] DEBUG: 5312: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 21:12:05,648 [root] DEBUG: 5312: DLL loaded at 0x00007FFF54170000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 21:12:05,648 [root] DEBUG: 5312: DLL loaded at 0x00007FFF4B680000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-28 21:12:05,656 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,656 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,657 [root] DEBUG: 5312: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 21:12:05,662 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,663 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,664 [root] DEBUG: 5312: DLL loaded at 0x00007FFF45580000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-28 21:12:05,670 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,670 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,675 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,676 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,680 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,681 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,685 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,685 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,690 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263167e+00 (from 6.262770e+00)
2026-05-28 21:12:05,691 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,691 [root] DEBUG: 5312: DLL loaded at 0x00007FFF52420000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-28 21:12:05,699 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263166e+00 (from 6.262770e+00)
2026-05-28 21:12:05,699 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,706 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263166e+00 (from 6.262770e+00)
2026-05-28 21:12:05,706 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,710 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263166e+00 (from 6.262770e+00)
2026-05-28 21:12:05,710 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,714 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263182e+00 (from 6.262770e+00)
2026-05-28 21:12:05,715 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,719 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263181e+00 (from 6.262770e+00)
2026-05-28 21:12:05,719 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,720 [root] DEBUG: 5312: DLL loaded at 0x00007FFF51A60000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 21:12:05,720 [root] DEBUG: 5312: DLL loaded at 0x00007FFF52860000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-05-28 21:12:05,720 [root] DEBUG: 5312: DLL loaded at 0x00007FFF4AF10000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 21:12:05,721 [root] DEBUG: 5312: DLL loaded at 0x00007FFF4BFB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 21:12:05,729 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263182e+00 (from 6.262770e+00)
2026-05-28 21:12:05,729 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,729 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263182e+00 (from 6.262770e+00)
2026-05-28 21:12:05,730 [root] DEBUG: 5312: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-28 21:12:05,730 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,734 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263183e+00 (from 6.262770e+00)
2026-05-28 21:12:05,735 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,736 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263182e+00 (from 6.262770e+00)
2026-05-28 21:12:05,737 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,739 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263182e+00 (from 6.262770e+00)
2026-05-28 21:12:05,739 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,741 [root] DEBUG: 5312: DLL loaded at 0x00007FFF515E0000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-28 21:12:05,741 [root] DEBUG: 5312: DLL loaded at 0x00007FFF51600000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-28 21:12:05,749 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263181e+00 (from 6.262770e+00)
2026-05-28 21:12:05,749 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,749 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263181e+00 (from 6.262770e+00)
2026-05-28 21:12:05,750 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 21:12:05,750 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,754 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263182e+00 (from 6.262770e+00)
2026-05-28 21:12:05,754 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263182e+00 (from 6.262770e+00)
2026-05-28 21:12:05,754 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263182e+00 (from 6.262770e+00)
2026-05-28 21:12:05,755 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,756 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,757 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,761 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263181e+00 (from 6.262770e+00)
2026-05-28 21:12:05,762 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,762 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263183e+00 (from 6.262770e+00)
2026-05-28 21:12:05,763 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263183e+00 (from 6.262770e+00)
2026-05-28 21:12:05,763 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,763 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,765 [root] DEBUG: 5312: CreateProcessHandler: Injection info set for new process 6000: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:05,765 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 6000
2026-05-28 21:12:05,766 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263183e+00 (from 6.262770e+00)
2026-05-28 21:12:05,766 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,767 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 21:12:05,767 [root] DEBUG: 5312: DLL loaded at 0x00007FFF572F0000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-05-28 21:12:05,768 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263183e+00 (from 6.262770e+00)
2026-05-28 21:12:05,768 [root] DEBUG: 5312: DLL loaded at 0x00007FFF50520000: C:\Windows\System32\MMDevApi (0x85000 bytes).
2026-05-28 21:12:05,769 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,770 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263183e+00 (from 6.262770e+00)
2026-05-28 21:12:05,770 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,773 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 6000
2026-05-28 21:12:05,774 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,775 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,777 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,778 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,779 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,779 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,779 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,780 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,783 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,784 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,785 [root] DEBUG: 5312: DLL loaded at 0x00007FFF52560000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-28 21:12:05,786 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,787 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,791 [root] DEBUG: 5312: CreateProcessHandler: Injection info set for new process 1676: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:05,792 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 1676
2026-05-28 21:12:05,797 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,797 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,798 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,799 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,800 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 1676
2026-05-28 21:12:05,807 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263196e+00 (from 6.262770e+00)
2026-05-28 21:12:05,808 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,815 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,815 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,817 [root] DEBUG: 5312: DLL loaded at 0x00007FFF49D10000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 21:12:05,823 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263198e+00 (from 6.262770e+00)
2026-05-28 21:12:05,824 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,824 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263198e+00 (from 6.262770e+00)
2026-05-28 21:12:05,825 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,826 [root] DEBUG: 5312: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 21:12:05,830 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,830 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,832 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,833 [root] DEBUG: 5312: CreateProcessHandler: Injection info set for new process 2132: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:05,833 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,838 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 2132
2026-05-28 21:12:05,838 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,839 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,839 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,839 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,840 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,840 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,841 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,841 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,844 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,846 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,848 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,852 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,854 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,854 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,854 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 2132
2026-05-28 21:12:05,858 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,860 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263225e+00 (from 6.262770e+00)
2026-05-28 21:12:05,861 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,862 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263197e+00 (from 6.262770e+00)
2026-05-28 21:12:05,863 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,863 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,864 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263225e+00 (from 6.262770e+00)
2026-05-28 21:12:05,864 [root] DEBUG: 5312: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 21:12:05,870 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263225e+00 (from 6.262770e+00)
2026-05-28 21:12:05,872 [root] DEBUG: 5312: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 21:12:05,874 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,874 [root] DEBUG: 5312: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 21:12:05,875 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263225e+00 (from 6.262770e+00)
2026-05-28 21:12:05,875 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,876 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,879 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,884 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,884 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,885 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,885 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,886 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,887 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,888 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,888 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,889 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,889 [root] DEBUG: 5312: DLL loaded at 0x00007FFF19960000: C:\Windows\System32\CryptoWinRT (0x61000 bytes).
2026-05-28 21:12:05,891 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,891 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,891 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,892 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,895 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,896 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,901 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,901 [root] DEBUG: 5312: DLL loaded at 0x00007FFF3E560000: C:\Windows\System32\CapabilityAccessManagerClient (0x3f000 bytes).
2026-05-28 21:12:05,902 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,902 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,903 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,907 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,908 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,908 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,908 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,909 [root] DEBUG: 5312: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 21:12:05,913 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,914 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,915 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56250000: C:\Windows\System32\FirewallAPI (0x96000 bytes).
2026-05-28 21:12:05,916 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,917 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,920 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,920 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,921 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,921 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,921 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,922 [root] DEBUG: 5312: DLL loaded at 0x00007FFF561E0000: C:\Windows\System32\fwbase (0x36000 bytes).
2026-05-28 21:12:05,923 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,927 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,927 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,927 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,928 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,932 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263226e+00 (from 6.262770e+00)
2026-05-28 21:12:05,933 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVol6.263226e+00 (from 6.262770e+00)
2026-05-28 21:12:05,934 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,934 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263226e+00 (from 6.262770e+00)
2026-05-28 21:12:05,935 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,935 [root] DEBUG: 5312: DLL loaded at 0x00007FFF57010000: C:\Windows\System32\ncrypt (0x27000 bytes).
2026-05-28 21:12:05,936 [root] DEBUG: 5312: DLL loaded at 0x00007FFF51040000: C:\Windows\System32\cryptngc (0x77000 bytes).
2026-05-28 21:12:05,937 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,937 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,941 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,942 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,943 [root] DEBUG: 5312: DLL loaded at 0x00007FFF56FD0000: C:\Windows\System32\NTASN1 (0x3b000 bytes).
2026-05-28 21:12:05,943 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,944 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,947 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,948 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,948 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,948 [root] DEBUG: 5312: DLL loaded at 0x00007FFF4F6E0000: C:\Windows\System32\usermgrproxy (0x54000 bytes).
2026-05-28 21:12:05,949 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,953 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,953 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,954 [root] DEBUG: 5312: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 21:12:05,958 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,959 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,964 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,965 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,966 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,967 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,969 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,969 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,971 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,971 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,973 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,974 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,975 [root] DEBUG: 5312: DLL loaded at 0x00007FFF55EF0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-28 21:12:05,975 [root] DEBUG: 5312: DLL loaded at 0x00007FFF53070000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-28 21:12:05,975 [root] DEBUG: 5312: DLL loaded at 0x00007FFF538A0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-28 21:12:05,976 [root] DEBUG: 5312: DLL loaded at 0x00007FFF43630000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-28 21:12:05,976 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,977 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,981 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,982 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,982 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,982 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:05,983 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,983 [root] DEBUG: 5312: DLL loaded at 0x00007FFF19930000: C:\Windows\system32\ngcksp (0x27000 bytes).
2026-05-28 21:12:05,983 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,987 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,987 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVol6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,988 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,993 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,993 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:05,994 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,994 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:05,994 [root] DEBUG: 5312: DLL loaded at 0x00007FFF43590000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-28 21:12:06,000 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,000 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,004 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,005 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,008 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,009 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,042 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,043 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,050 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,052 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,058 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,059 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,059 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,059 [root] DEBUG: 5312: DLL loaded at 0x00007FFF55220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-28 21:12:06,060 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,063 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,064 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,064 [root] DEBUG: 5312: DLL loaded at 0x00007FFF1EF30000: C:\Windows\System32\Windows.Media (0x726000 bytes).
2026-05-28 21:12:06,071 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,071 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,075 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,076 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,080 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,081 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,082 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,083 [root] DEBUG: 5312: CreateProcessHandler: Injection info set for new process 9236: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:06,083 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,084 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 9236
2026-05-28 21:12:06,088 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,088 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,089 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,089 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,089 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,090 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,090 [root] DEBUG: 5312: CreateProcessHandler: Injection info set for new process 9276: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:06,091 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 9236
2026-05-28 21:12:06,091 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 9276
2026-05-28 21:12:06,094 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,094 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,095 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,095 [root] DEBUG: 5312: DLL loaded at 0x00007FFF43990000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-28 21:12:06,096 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,096 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,097 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,097 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,098 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,098 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 9276
2026-05-28 21:12:06,101 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,101 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,102 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,102 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,103 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,103 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,106 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,107 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,107 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,108 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,108 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,109 [root] DEBUG: 5312: DLL loaded at 0x00007FFF488B0000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-28 21:12:06,109 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,113 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,114 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,115 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,117 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,119 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,119 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,123 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,124 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,125 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,126 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,130 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,134 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,139 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,146 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,154 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,158 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,159 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,159 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,159 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,160 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,160 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263230e+00 (from 6.262770e+00)
2026-05-28 21:12:06,160 [root] DEBUG: 5312: DLL loaded at 0x00007FFF42E10000: C:\Windows\system32\explorerframe (0x244000 bytes).
2026-05-28 21:12:06,161 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,163 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,163 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,164 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,164 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,165 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,165 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,166 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,166 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,169 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,177 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,182 [root] DEBUG: 5312: CreateProcessHandler: Injection info set for new process 9624: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:06,183 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,185 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,185 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,186 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,186 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,186 [root] DEBUG: 5312: DLL loaded at 0x00007FFF4F950000: C:\Windows\system32\wlanapi (0x74000 bytes).
2026-05-28 21:12:06,187 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,187 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,188 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 9624
2026-05-28 21:12:06,188 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,189 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,189 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263227e+00 (from 6.262770e+00)
2026-05-28 21:12:06,190 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,191 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,191 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,191 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,192 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,193 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,193 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,194 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,195 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,195 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,195 [root] DEBUG: 5312: ProcessMessage: Skipping monitoring process 9624
2026-05-28 21:12:06,201 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,201 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,202 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,203 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,204 [root] DEBUG: 5312:
2026-05-28 21:12:06,205 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,208 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,209 [root] DEBUG: 5312: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263228e+00 (from 6.262770e+00)
2026-05-28 21:12:06,213 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,213 [root] DEBUG: 5312: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:06,658 [root] DEBUG: package modules.packages.edge does not support configure, ignoring
2026-05-28 21:12:06,658 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'
2026-05-28 21:12:06,659 [lib.core.compound] INFO: C:\Users\admin\AppData\Local\Temp already exists, skipping creation
2026-05-28 21:12:06,660 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" with arguments ""r"" with pid 9860
2026-05-28 21:12:06,660 [lib.api.process] INFO: Monitor config for process 9860: C:\lpw_albt\dll\9860.ini
2026-05-28 21:12:06,661 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:06,662 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:06,667 [root] DEBUG: Loader: Injecting process 9860 (thread 9864) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:06,667 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:06,668 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:06,669 [lib.api.process] INFO: Injected into 64-bit <Process 9860 msedge.exe>
2026-05-28 21:12:08,338 [root] DEBUG: 4484: CreateProcessHandler: Injection info set for new process 9932: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:08,339 [root] INFO: Announced 64-bit process name: chrome.exe pid: 9932
2026-05-28 21:12:08,340 [lib.api.process] INFO: Monitor config for process 9932: C:\lpw_albt\dll\9932.ini
2026-05-28 21:12:08,341 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:08,343 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:08,349 [root] DEBUG: Loader: Injecting process 9932 (thread 9936) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:08,350 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:08,351 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:08,353 [lib.api.process] INFO: Injected into 64-bit <Process 9932 chrome.exe>
2026-05-28 21:12:08,355 [root] INFO: Announced 64-bit process name: chrome.exe pid: 9932
2026-05-28 21:12:08,355 [lib.api.process] INFO: Monitor config for process 9932: C:\lpw_albt\dll\9932.ini
2026-05-28 21:12:08,355 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:08,356 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:08,360 [root] DEBUG: Loader: Injecting process 9932 (thread 9936) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:08,361 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:12:08,362 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:08,363 [lib.api.process] INFO: Injected into 64-bit <Process 9932 chrome.exe>
2026-05-28 21:12:08,378 [root] DEBUG: 9932: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:08,379 [root] DEBUG: 9932: Interactive desktop enabled.
2026-05-28 21:12:08,379 [root] DEBUG: 9932: Dropped file limit defaulting to 100.
2026-05-28 21:12:08,384 [root] DEBUG: 9932: Chrome-specific hook-set enabled.
2026-05-28 21:12:08,386 [root] DEBUG: 9932: Disabling sleep skipping.
2026-05-28 21:12:08,388 [root] DEBUG: 9932: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:08,401 [root] DEBUG: 9932: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:08,402 [root] DEBUG: 9932: Monitor initialised: 64-bit capemon loaded in process 9932 at 0x00007FFF18240000, thread 9936, image base 0x00007FF7AD300000, stack from 0x0000001B65BF4000-0x0000001B65C00000
2026-05-28 21:12:08,402 [root] DEBUG: 9932: Commandline: "C:\Program Files\Google\Chrome\Application\chrome.exe"
2026-05-28 21:12:08,410 [root] DEBUG: 9932: Hooked 2 out of 2 functions
2026-05-28 21:12:08,435 [root] DEBUG: 9932: Syscall hook installed, syscall logging level 1
2026-05-28 21:12:08,439 [root] DEBUG: 9932: RestoreHeaders: Restored original import table.
2026-05-28 21:12:08,440 [root] INFO: Loaded monitor into process with pid 9932
2026-05-28 21:12:08,441 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 21:12:08,450 [root] DEBUG: 9932: InstrumentationCallback: Added region at 0x00007FFF17D90014 (base 0x00007FFF17AE0000) to tracked regions list (thread 9936).
2026-05-28 21:12:08,452 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,453 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56770000: C:\Windows\system32\ntmarta (0x33000 bytes).
2026-05-28 21:12:08,457 [root] DEBUG: 9932: caller_dispatch: Added region at 0x00007FF7AD300000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7AD3372AF, thread 9936).
2026-05-28 21:12:08,460 [root] DEBUG: 9932: ProcessImageBase: Main module image at 0x00007FF7AD300000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:12:08,466 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.262818e+00 (from 6.262660e+00)
2026-05-28 21:12:08,466 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,471 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.262819e+00 (from 6.262660e+00)
2026-05-28 21:12:08,471 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,472 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 21:12:08,472 [root] DEBUG: 9932: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 21:12:08,477 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.262818e+00 (from 6.262660e+00)
2026-05-28 21:12:08,478 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,480 [root] DEBUG: 9932: CreateProcessHandler: Injection info set for new process 10132: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:08,480 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 10132
2026-05-28 21:12:08,485 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.262818e+00 (from 6.262660e+00)
2026-05-28 21:12:08,485 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,485 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 10132
2026-05-28 21:12:08,513 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263046e+00 (from 6.262660e+00)
2026-05-28 21:12:08,514 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,540 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263046e+00 (from 6.262660e+00)
2026-05-28 21:12:08,542 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,546 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263046e+00 (from 6.262660e+00)
2026-05-28 21:12:08,546 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,550 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:08,551 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,555 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263046e+00 (from 6.262660e+00)
2026-05-28 21:12:08,556 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,556 [root] DEBUG: 9932: DLL loaded at 0x00007FFF453C0000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-28 21:12:08,557 [root] DEBUG: 9932: DLL loaded at 0x00007FFF49A90000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-28 21:12:08,557 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57350000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-28 21:12:08,558 [root] DEBUG: 9932: DLL loaded at 0x00007FFF00C20000: C:\Program Files\Google\Chrome\Application\148.0.7778.217\chrome (0x10fdc000 bytes).
2026-05-28 21:12:08,563 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:08,563 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,567 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:08,569 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,570 [root] DEBUG: 9932: DLL loaded at 0x00007FFF45010000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-28 21:12:08,575 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263047e+00 (from 6.262660e+00)
2026-05-28 21:12:08,575 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,579 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263047e+00 (from 6.262660e+00)
2026-05-28 21:12:08,580 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,580 [root] DEBUG: 9932: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:12:08,587 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263046e+00 (from 6.262660e+00)
2026-05-28 21:12:08,587 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,588 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57520000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-28 21:12:08,592 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263047e+00 (from 6.262660e+00)
2026-05-28 21:12:08,592 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,593 [root] DEBUG: 9932: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 21:12:08,597 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263047e+00 (from 6.262660e+00)
2026-05-28 21:12:08,597 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,597 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-28 21:12:08,602 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263047e+00 (from 6.262660e+00)
2026-05-28 21:12:08,603 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,603 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-28 21:12:08,612 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263046e+00 (from 6.262660e+00)
2026-05-28 21:12:08,613 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,617 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263046e+00 (from 6.262660e+00)
2026-05-28 21:12:08,618 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,619 [root] DEBUG: 9932: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\netapi32 (0x19000 bytes).
2026-05-28 21:12:08,622 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263047e+00 (from 6.262660e+00)
2026-05-28 21:12:08,623 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,627 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263047e+00 (from 6.262660e+00)
2026-05-28 21:12:08,627 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,631 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,632 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,633 [root] DEBUG: 9932: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:08,633 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-28 21:12:08,635 [root] DEBUG: 9932: DLL loaded at 0x00007FFF52F20000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 21:12:08,640 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,640 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,641 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57560000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-28 21:12:08,648 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,649 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,653 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,653 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,657 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,657 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,661 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,664 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,669 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,669 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,669 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,670 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,670 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,670 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,671 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,671 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,672 [root] DEBUG: 9932: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 21:12:08,676 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,676 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,676 [root] DEBUG: 9932: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:12:08,677 [lib.api.process] INFO: Successfully resumed process with pid 9860
2026-05-28 21:12:08,680 [root] INFO: Process with pid 5312 appears to have terminated
2026-05-28 21:12:08,681 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,681 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,682 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:12:08,686 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,686 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,687 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:12:08,691 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,692 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,692 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,692 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,697 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,697 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,698 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,698 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,698 [root] DEBUG: 9932: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:08,699 [root] DEBUG: 9932: DLL loaded at 0x00007FFF4D340000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-28 21:12:08,702 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,702 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,703 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,704 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,706 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,706 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,708 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,708 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,713 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,713 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,717 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,718 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,722 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,723 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,725 [root] DEBUG: 9860: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:08,725 [root] DEBUG: 9860: Interactive desktop enabled.
2026-05-28 21:12:08,726 [root] DEBUG: 9860: Dropped file limit defaulting to 100.
2026-05-28 21:12:08,727 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,728 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,730 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 21:12:08,731 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57010000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 21:12:08,731 [root] DEBUG: 9932: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:12:08,732 [root] DEBUG: 9932: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 21:12:08,733 [root] DEBUG: 9932: DLL loaded at 0x00007FFF15300000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-28 21:12:08,734 [root] DEBUG: 9932: DLL loaded at 0x00007FFF3FB00000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-28 21:12:08,734 [root] DEBUG: 9860: Edge-specific hook-set enabled.
2026-05-28 21:12:08,736 [root] DEBUG: 9860: Disabling sleep skipping.
2026-05-28 21:12:08,737 [root] DEBUG: 9860: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:08,738 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,738 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,739 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56FD0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 21:12:08,744 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263025e+00 (from 6.262660e+00)
2026-05-28 21:12:08,744 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,745 [root] DEBUG: 9932: DLL loaded at 0x00007FFF44D50000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-28 21:12:08,749 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,749 [root] DEBUG: 9860: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:08,750 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,750 [root] DEBUG: 9860: Monitor initialised: 64-bit capemon loaded in process 9860 at 0x00007FFF18240000, thread 9864, image base 0x00007FF7F5380000, stack from 0x000000C4485F4000-0x000000C448600000
2026-05-28 21:12:08,751 [root] DEBUG: 9860: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "r"
2026-05-28 21:12:08,755 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,757 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,758 [root] DEBUG: 9932: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\netapi32 (0x19000 bytes).
2026-05-28 21:12:08,760 [root] DEBUG: 9860: Hooked 2 out of 2 functions
2026-05-28 21:12:08,764 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,765 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,769 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263022e+00 (from 6.262660e+00)
2026-05-28 21:12:08,769 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,770 [root] DEBUG: 9932: DLL loaded at 0x00007FFF569F0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-28 21:12:08,770 [root] DEBUG: 9932: DLL loaded at 0x00007FFF52960000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-28 21:12:08,776 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,777 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,777 [root] DEBUG: 9932: DLL loaded at 0x00007FFF58B20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 21:12:08,781 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,782 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,782 [root] DEBUG: 9932: DLL loaded at 0x00007FFF48330000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-28 21:12:08,788 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263023e+00 (from 6.262660e+00)
2026-05-28 21:12:08,789 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,789 [root] DEBUG: 9932: DLL loaded at 0x00007FFF515C0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 21:12:08,794 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263028e+00 (from 6.262660e+00)
2026-05-28 21:12:08,795 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,795 [root] DEBUG: 9932: DLL loaded at 0x00007FFF515A0000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 21:12:08,800 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263028e+00 (from 6.262660e+00)
2026-05-28 21:12:08,800 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,801 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56A40000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 21:12:08,801 [root] DEBUG: 9860: Syscall hook installed, syscall logging level 1
2026-05-28 21:12:08,806 [root] DEBUG: 9860: RestoreHeaders: Restored original import table.
2026-05-28 21:12:08,806 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263030e+00 (from 6.262660e+00)
2026-05-28 21:12:08,806 [root] INFO: Loaded monitor into process with pid 9860
2026-05-28 21:12:08,807 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,809 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 21:12:08,811 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263030e+00 (from 6.262660e+00)
2026-05-28 21:12:08,811 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,814 [root] DEBUG: 9860: DLL loaded at 0x00007FFF43500000: C:\Windows\SYSTEM32\version (0xa000 bytes).
2026-05-28 21:12:08,815 [root] DEBUG: 9860: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 21:12:08,816 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263030e+00 (from 6.262660e+00)
2026-05-28 21:12:08,816 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,817 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 21:12:08,817 [root] DEBUG: 9860: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 21:12:08,818 [root] DEBUG: 9860: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-05-28 21:12:08,819 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 21:12:08,822 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263030e+00 (from 6.262660e+00)
2026-05-28 21:12:08,822 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,828 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263030e+00 (from 6.262660e+00)
2026-05-28 21:12:08,829 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,830 [root] DEBUG: 9932: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:12:08,837 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,838 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,846 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,847 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,857 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,859 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,868 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,869 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,875 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,877 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,893 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263030e+00 (from 6.262660e+00)
2026-05-28 21:12:08,894 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,902 [root] DEBUG: 9932: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 21:12:08,904 [root] DEBUG: 9932: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 21:12:08,905 [root] DEBUG: 9932: DLL loaded at 0x00007FFF54170000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 21:12:08,906 [root] DEBUG: 9932: DLL loaded at 0x00007FFF4B680000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-28 21:12:08,920 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,922 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,930 [root] DEBUG: 9932: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 21:12:08,946 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263030e+00 (from 6.262660e+00)
2026-05-28 21:12:08,947 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,949 [root] DEBUG: 9932: DLL loaded at 0x00007FFF45580000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-28 21:12:08,961 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263030e+00 (from 6.262660e+00)
2026-05-28 21:12:08,962 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,973 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,975 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,991 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,992 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:08,998 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:08,999 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,004 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:09,005 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,006 [root] DEBUG: 9932: DLL loaded at 0x00007FFF52420000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-28 21:12:09,012 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:09,012 [root] DEBUG: 9860: DLL loaded at 0x00007FFF453C0000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-28 21:12:09,012 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,013 [root] DEBUG: 9860: DLL loaded at 0x00007FFEED560000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge (0x136be000 bytes).
2026-05-28 21:12:09,016 [root] DEBUG: 9860: DLL loaded at 0x00007FFF45010000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-28 21:12:09,018 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:09,018 [root] DEBUG: 9860: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:12:09,019 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,023 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263029e+00 (from 6.262660e+00)
2026-05-28 21:12:09,024 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,025 [root] DEBUG: 9860: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:12:09,026 [root] DEBUG: 9860: CreateProcessHandler: Injection info set for new process 10508: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:09,026 [root] DEBUG: 9860: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:12:09,027 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 10508
2026-05-28 21:12:09,028 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 10508
2026-05-28 21:12:09,028 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4D390000: C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).
2026-05-28 21:12:09,028 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263043e+00 (from 6.262660e+00)
2026-05-28 21:12:09,029 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,029 [root] DEBUG: 9860: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:09,030 [root] DEBUG: 9860: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 21:12:09,034 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263042e+00 (from 6.262660e+00)
2026-05-28 21:12:09,034 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,035 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57520000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-28 21:12:09,035 [root] DEBUG: 9932: DLL loaded at 0x00007FFF51A60000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 21:12:09,036 [root] DEBUG: 9860: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 21:12:09,037 [root] DEBUG: 9932: DLL loaded at 0x00007FFF52860000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-05-28 21:12:09,038 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-28 21:12:09,038 [root] DEBUG: 9932: DLL loaded at 0x00007FFF4AF10000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 21:12:09,039 [root] DEBUG: 9932: DLL loaded at 0x00007FFF4BFB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 21:12:09,039 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-28 21:12:09,041 [root] DEBUG: 9860: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:09,041 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4D320000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-28 21:12:09,043 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:12:09,044 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 21:12:09,044 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57010000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 21:12:09,045 [root] DEBUG: 9860: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:12:09,045 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263043e+00 (from 6.262660e+00)
2026-05-28 21:12:09,046 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 21:12:09,046 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263043e+00 (from 6.262660e+00)
2026-05-28 21:12:09,046 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,047 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,047 [root] DEBUG: 9860: DLL loaded at 0x00007FFF15300000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-28 21:12:09,047 [root] DEBUG: 9932: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-28 21:12:09,048 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4D2E0000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-28 21:12:09,048 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:12:09,049 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56FD0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 21:12:09,050 [root] DEBUG: 9860: DLL loaded at 0x00007FFF43550000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-28 21:12:09,052 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263042e+00 (from 6.262660e+00)
2026-05-28 21:12:09,054 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,054 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263042e+00 (from 6.262660e+00)
2026-05-28 21:12:09,055 [root] DEBUG: 9860: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:09,055 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,055 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-28 21:12:09,056 [root] DEBUG: 9860: DLL loaded at 0x00007FFF52F20000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 21:12:09,057 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57560000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-28 21:12:09,058 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263043e+00 (from 6.262660e+00)
2026-05-28 21:12:09,059 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,059 [root] DEBUG: 9932: DLL loaded at 0x00007FFF515E0000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-28 21:12:09,060 [root] DEBUG: 9932: DLL loaded at 0x00007FFF51600000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-28 21:12:09,064 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263042e+00 (from 6.262660e+00)
2026-05-28 21:12:09,065 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263042e+00 (from 6.262660e+00)
2026-05-28 21:12:09,065 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,066 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,066 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 21:12:09,067 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263044e+00 (from 6.262660e+00)
2026-05-28 21:12:09,068 [root] DEBUG: 9860: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 21:12:09,069 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,070 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4D370000: C:\Windows\System32\AssignedAccessRuntime (0x14000 bytes).
2026-05-28 21:12:09,071 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:09,071 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:12:09,071 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,072 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:09,072 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:12:09,073 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,073 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4D3D0000: C:\Windows\System32\SystemSettings.DataModel (0x74000 bytes).
2026-05-28 21:12:09,074 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:09,074 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,074 [root] DEBUG: 9860: DLL loaded at 0x00007FFF49A90000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-28 21:12:09,076 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:09,076 [root] DEBUG: 9932: CreateProcessHandler: Injection info set for new process 10936: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:09,076 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,077 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 10936
2026-05-28 21:12:09,077 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:09,078 [root] DEBUG: 9860: DLL loaded at 0x00007FFF44D50000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-28 21:12:09,078 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,079 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57350000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-28 21:12:09,080 [root] DEBUG: 9860: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 21:12:09,081 [root] DEBUG: 9860: DLL loaded at 0x00007FFF569F0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-28 21:12:09,081 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:09,082 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:09,083 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263045e+00 (from 6.262660e+00)
2026-05-28 21:12:09,083 [root] DEBUG: 9860: DLL loaded at 0x00007FFF52960000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-28 21:12:09,085 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,085 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,085 [root] DEBUG: 9860: DLL loaded at 0x00007FFF58B20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 21:12:09,086 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 21:12:09,086 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,087 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 10936
2026-05-28 21:12:09,087 [root] DEBUG: 9932: DLL loaded at 0x00007FFF572F0000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-05-28 21:12:09,087 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-28 21:12:09,088 [root] DEBUG: 9932: DLL loaded at 0x00007FFF50520000: C:\Windows\System32\MMDevApi (0x85000 bytes).
2026-05-28 21:12:09,088 [root] DEBUG: 9860: DLL loaded at 0x00007FFF515C0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 21:12:09,089 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4B070000: C:\Windows\System32\StructuredQuery (0xa6000 bytes).
2026-05-28 21:12:09,090 [root] DEBUG: 9860: DLL loaded at 0x00007FFF515A0000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 21:12:09,091 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263055e+00 (from 6.262660e+00)
2026-05-28 21:12:09,091 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263053e+00 (from 6.262660e+00)
2026-05-28 21:12:09,092 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,092 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,092 [root] DEBUG: 9860: DLL loaded at 0x00007FFF52860000: C:\Windows\SYSTEM32\PROPSYS (0xf6000 bytes).
2026-05-28 21:12:09,096 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263052e+00 (from 6.262660e+00)
2026-05-28 21:12:09,097 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263052e+00 (from 6.262660e+00)
2026-05-28 21:12:09,097 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,098 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263052e+00 (from 6.262660e+00)
2026-05-28 21:12:09,098 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,099 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,101 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56A40000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 21:12:09,103 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263052e+00 (from 6.262660e+00)
2026-05-28 21:12:09,104 [root] DEBUG: 9932: CreateProcessHandler: Injection info set for new process 11144: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:09,105 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,105 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 11144
2026-05-28 21:12:09,106 [root] DEBUG: 9932: DLL loaded at 0x00007FFF52560000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-28 21:12:09,107 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4CBF0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 21:12:09,109 [root] DEBUG: 9860: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 21:12:09,110 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263054e+00 (from 6.262660e+00)
2026-05-28 21:12:09,110 [root] DEBUG: 9860: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 21:12:09,110 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263054e+00 (from 6.262660e+00)
2026-05-28 21:12:09,111 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,111 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,111 [root] DEBUG: 9860: DLL loaded at 0x00007FFF54170000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 21:12:09,112 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263054e+00 (from 6.262660e+00)
2026-05-28 21:12:09,112 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4B680000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-28 21:12:09,112 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 11144
2026-05-28 21:12:09,114 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,117 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4CD70000: C:\Windows\system32\Windows.Storage.Search (0xc6000 bytes).
2026-05-28 21:12:09,118 [root] DEBUG: 9932: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 21:12:09,119 [root] DEBUG: 9860: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 21:12:09,122 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263056e+00 (from 6.262660e+00)
2026-05-28 21:12:09,123 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4CD40000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-05-28 21:12:09,124 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263056e+00 (from 6.262660e+00)
2026-05-28 21:12:09,124 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,125 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,125 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263056e+00 (from 6.262660e+00)
2026-05-28 21:12:09,126 [root] DEBUG: 9860: DLL loaded at 0x00007FFF45580000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-28 21:12:09,126 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,127 [root] DEBUG: 9932: DLL loaded at 0x00007FFF49D10000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 21:12:09,129 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263056e+00 (from 6.262660e+00)
2026-05-28 21:12:09,130 [root] DEBUG: 9860: DLL loaded at 0x00007FFF47AB0000: C:\Windows\SYSTEM32\edputil (0x24000 bytes).
2026-05-28 21:12:09,130 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,132 [root] DEBUG: 9860: DLL loaded at 0x00007FFF52420000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-28 21:12:09,134 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263058e+00 (from 6.262660e+00)
2026-05-28 21:12:09,134 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,138 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4D6A0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 21:12:09,138 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263058e+00 (from 6.262660e+00)
2026-05-28 21:12:09,139 [root] DEBUG: 9860: DLL loaded at 0x00007FFF47980000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-05-28 21:12:09,139 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,140 [root] DEBUG: 9932: DLL loaded at 0x00007FFF3E560000: C:\Windows\System32\CapabilityAccessManagerClient (0x3f000 bytes).
2026-05-28 21:12:09,141 [root] DEBUG: 9860: DLL loaded at 0x00007FFF51A60000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 21:12:09,141 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263059e+00 (from 6.262660e+00)
2026-05-28 21:12:09,141 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4AF10000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 21:12:09,142 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4BFB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 21:12:09,142 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,150 [root] DEBUG: 9932: CreateProcessHandler: Injection info set for new process 11460: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:09,151 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263059e+00 (from 6.262660e+00)
2026-05-28 21:12:09,151 [root] DEBUG: 9860: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-28 21:12:09,152 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263059e+00 (from 6.262660e+00)
2026-05-28 21:12:09,153 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263059e+00 (from 6.262660e+00)
2026-05-28 21:12:09,153 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 11460
2026-05-28 21:12:09,154 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,155 [root] DEBUG: 9860: DLL loaded at 0x00007FFF52560000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-28 21:12:09,155 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,157 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,158 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,159 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,166 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,166 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,167 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,168 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,168 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 11460
2026-05-28 21:12:09,169 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,170 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,171 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,171 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,172 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263082e+00 (from 6.262660e+00)
2026-05-28 21:12:09,173 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,173 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263082e+00 (from 6.262660e+00)
2026-05-28 21:12:09,174 [root] DEBUG: 9932: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 21:12:09,180 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,180 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,180 [root] DEBUG: 9932: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 21:12:09,182 [root] DEBUG: 9860: DLL loaded at 0x00007FFF16430000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\oneauth (0x5c4000 bytes).
2026-05-28 21:12:09,183 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,185 [root] DEBUG: 9932: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 21:12:09,185 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,188 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,188 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,189 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,191 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,191 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,192 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,192 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,195 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,196 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,198 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,199 [root] DEBUG: 9932: DLL loaded at 0x00007FFF4F6E0000: C:\Windows\System32\usermgrproxy (0x54000 bytes).
2026-05-28 21:12:09,200 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,200 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,201 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,201 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,206 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,206 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,208 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,209 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,210 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,210 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,211 [root] DEBUG: 9932: DLL loaded at 0x00007FFF19960000: C:\Windows\System32\CryptoWinRT (0x61000 bytes).
2026-05-28 21:12:09,211 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,214 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,215 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,218 [root] DEBUG: 9860: DLL loaded at 0x00007FFF48330000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-28 21:12:09,219 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,219 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,220 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,222 [root] DEBUG: 9860: DLL loaded at 0x00007FFF515E0000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-28 21:12:09,222 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,223 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,224 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,224 [root] DEBUG: 9860: DLL loaded at 0x00007FFF51600000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-28 21:12:09,229 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 21:12:09,230 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,230 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263083e+00 (from 6.262660e+00)
2026-05-28 21:12:09,231 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,231 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,232 [root] DEBUG: 9932: DLL loaded at 0x00007FFF57010000: C:\Windows\System32\ncrypt (0x27000 bytes).
2026-05-28 21:12:09,232 [root] DEBUG: 9860: DLL loaded at 0x00007FFF49D10000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 21:12:09,234 [root] DEBUG: 9932: DLL loaded at 0x00007FFF51040000: C:\Windows\System32\cryptngc (0x77000 bytes).
2026-05-28 21:12:09,236 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,238 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,240 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,242 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,243 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56FD0000: C:\Windows\System32\NTASN1 (0x3b000 bytes).
2026-05-28 21:12:09,243 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,243 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,245 [root] DEBUG: 9860: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 21:12:09,249 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263087e+00 (from 6.262660e+00)
2026-05-28 21:12:09,250 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263087e+00 (from 6.262660e+00)
2026-05-28 21:12:09,252 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,257 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,258 [root] DEBUG: 9860: caller_dispatch: Added region at 0x00007FF7F5380000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7F5477D66, thread 10856).
2026-05-28 21:12:09,259 [root] DEBUG: 9932: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 21:12:09,258 [root] DEBUG: 9860: CreateProcessHandler: Injection info set for new process 12036: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:09,260 [root] DEBUG: 9860: DLL loaded at 0x00007FFF43590000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-28 21:12:09,262 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12036
2026-05-28 21:12:09,263 [root] DEBUG: 9860: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 21:12:09,264 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,265 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,265 [root] DEBUG: 9860: DLL loaded at 0x00007FFF409A0000: C:\Windows\System32\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).
2026-05-28 21:12:09,266 [root] DEBUG: 9860: ProcessImageBase: Main module image at 0x00007FF7F5380000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:12:09,267 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12036
2026-05-28 21:12:09,269 [root] DEBUG: 9860: CreateProcessHandler: Injection info set for new process 12088: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:09,269 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,270 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,271 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12088
2026-05-28 21:12:09,276 [root] DEBUG: 9932: DLL loaded at 0x00007FFF56250000: C:\Windows\System32\FirewallAPI (0x96000 bytes).
2026-05-28 21:12:09,279 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12088
2026-05-28 21:12:09,283 [root] DEBUG: 9860: CreateProcessHandler: Injection info set for new process 12116: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:09,283 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,283 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,284 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12116
2026-05-28 21:12:09,284 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,286 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12116
2026-05-28 21:12:09,288 [root] DEBUG: 9932: DLL loaded at 0x00007FFF561E0000: C:\Windows\System32\fwbase (0x36000 bytes).
2026-05-28 21:12:09,288 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,293 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,296 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,298 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,305 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,306 [root] DEBUG: 9860: DLL loaded at 0x00007FFF55EF0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-28 21:12:09,306 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,307 [root] DEBUG: 9860: DLL loaded at 0x00007FFF53070000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-28 21:12:09,307 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,308 [root] DEBUG: 9860: DLL loaded at 0x00007FFF538A0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-28 21:12:09,311 [root] DEBUG: 9860: DLL loaded at 0x00007FFF43630000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-28 21:12:09,313 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,314 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,320 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,320 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,321 [root] DEBUG: 9932: DLL loaded at 0x00007FFF55EF0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-28 21:12:09,322 [root] DEBUG: 9932: DLL loaded at 0x00007FFF53070000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-28 21:12:09,322 [root] DEBUG: 9932: DLL loaded at 0x00007FFF538A0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-28 21:12:09,323 [root] DEBUG: 9932: DLL loaded at 0x00007FFF43630000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-28 21:12:09,327 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,327 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,328 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,328 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,329 [root] DEBUG: 9932: DLL loaded at 0x00007FFF19930000: C:\Windows\system32\ngcksp (0x27000 bytes).
2026-05-28 21:12:09,333 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,334 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,336 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,337 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,337 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,338 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,339 [root] DEBUG: 9932: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 21:12:09,340 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4D250000: C:\Windows\System32\Windows.System.Profile.RetailInfo (0x28000 bytes).
2026-05-28 21:12:09,342 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,342 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,356 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,357 [root] DEBUG: 9860: DLL loaded at 0x00007FFF55220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-28 21:12:09,357 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,361 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,362 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,363 [root] DEBUG: 9860: DLL loaded at 0x00007FFF43990000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-28 21:12:09,368 [root] DEBUG: 9860: CreateProcessHandler: Injection info set for new process 12440: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:09,368 [root] DEBUG: 9860: DLL loaded at 0x00007FFF488B0000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-28 21:12:09,368 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,369 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12440
2026-05-28 21:12:09,369 [root] DEBUG: 9860: CreateProcessHandler: Injection info set for new process 12468: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:09,370 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12440
2026-05-28 21:12:09,370 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,370 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12468
2026-05-28 21:12:09,371 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 12468
2026-05-28 21:12:09,374 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,374 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,379 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,379 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,385 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,386 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,386 [root] DEBUG: 9932: DLL loaded at 0x00007FFF43590000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-28 21:12:09,391 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,393 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,394 [root] DEBUG: 9860: DLL loaded at 0x00007FFF3EA70000: C:\Windows\System32\Windows.Security.Authentication.OnlineId (0xf4000 bytes).
2026-05-28 21:12:09,400 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,400 [root] DEBUG: 9860: DLL loaded at 0x00007FFF43550000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-28 21:12:09,401 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,405 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,410 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,456 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,464 [root] DEBUG: 9860: DLL loaded at 0x00007FFF456D0000: C:\Windows\System32\Windows.Security.Authentication.Web.Core (0x11d000 bytes).
2026-05-28 21:12:09,465 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,471 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,472 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263086e+00 (from 6.262660e+00)
2026-05-28 21:12:09,472 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,473 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,474 [root] DEBUG: 9932: DLL loaded at 0x00007FFF55220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-28 21:12:09,478 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,480 [root] DEBUG: 9860: DLL loaded at 0x00007FFF3F6A0000: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains (0x9e000 bytes).
2026-05-28 21:12:09,482 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,483 [root] DEBUG: 9932: DLL loaded at 0x00007FFF1EF30000: C:\Windows\System32\Windows.Media (0x726000 bytes).
2026-05-28 21:12:09,492 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,493 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,493 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4CFA0000: C:\Windows\SYSTEM32\VCRUNTIME140 (0x1e000 bytes).
2026-05-28 21:12:09,496 [root] DEBUG: 9860: DLL loaded at 0x00007FFF4D010000: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions (0x17000 bytes).
2026-05-28 21:12:09,496 [root] DEBUG: 9860: DLL loaded at 0x00007FFF48780000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 21:12:09,497 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,498 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,498 [root] DEBUG: 9860: DLL loaded at 0x00007FFF3E730000: C:\Windows\System32\vaultcli (0x51000 bytes).
2026-05-28 21:12:09,503 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,504 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,504 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,505 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,506 [root] DEBUG: 9932: CreateProcessHandler: Injection info set for new process 12844: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:09,512 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 12844
2026-05-28 21:12:09,515 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,516 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,517 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,517 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,519 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,521 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,522 [root] DEBUG: 9860: DLL loaded at 0x00007FFF15270000: C:\Windows\System32\MicrosoftAccountWAMExtension (0x8c000 bytes).
2026-05-28 21:12:09,523 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 12844
2026-05-28 21:12:09,522 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,524 [root] DEBUG: 9932: CreateProcessHandler: Injection info set for new process 12900: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:09,527 [root] DEBUG: 9860: DLL loaded at 0x00007FFF57130000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 21:12:09,529 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,531 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,531 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,531 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,532 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 21:12:09,532 [root] DEBUG: 9932: DLL loaded at 0x00007FFF43990000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-28 21:12:09,532 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,533 [root] DEBUG: 9860: DLL loaded at 0x00007FFF56630000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-28 21:12:09,534 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 12900
2026-05-28 21:12:09,540 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,541 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,542 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,542 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,543 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,543 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,544 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,549 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,555 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,556 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263085e+00 (from 6.262660e+00)
2026-05-28 21:12:09,557 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,557 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,557 [root] DEBUG: 9932: ProcessMessage: Skipping monitoring process 12900
2026-05-28 21:12:09,558 [root] DEBUG: 9932: DLL loaded at 0x00007FFF488B0000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-28 21:12:09,569 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,570 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,570 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,570 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,572 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,575 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,576 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,580 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,581 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,582 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,582 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,593 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,593 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,596 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,600 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,607 [root] DEBUG: 9932: ProcessTrackedRegion: Region at 0x00007FFF17AE0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:09,626 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:09,627 [root] DEBUG: 9932:
2026-05-28 21:12:09,722 [root] DEBUG: 9932: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF17AE0000: 6.263084e+00 (from 6.262660e+00)
2026-05-28 21:12:10,692 [root] INFO: Process with pid 9932 appears to have terminated
2026-05-28 21:12:10,980 [root] DEBUG: 9860: DLL loaded at 0x00007FFF3FD40000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-28 21:12:11,039 [root] DEBUG: 9860: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:11,041 [root] DEBUG: 9860: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 21:12:11,727 [root] DEBUG: 9860: CreateProcessHandler: Injection info set for new process 13248: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:11,729 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 13248
2026-05-28 21:12:11,729 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 13248
2026-05-28 21:12:12,894 [root] DEBUG: 9860: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 21:12:12,895 [root] DEBUG: 9860: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 21:12:12,895 [root] DEBUG: 9860: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 21:12:13,263 [root] DEBUG: 9860: CreateProcessHandler: Injection info set for new process 10064: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:13,264 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 10064
2026-05-28 21:12:13,266 [root] DEBUG: 9860: ProcessMessage: Skipping monitoring process 10064
2026-05-28 21:12:13,709 [root] INFO: Process with pid 9860 appears to have terminated
2026-05-28 21:12:14,106 [root] DEBUG: 4484: CreateProcessHandler: Injection info set for new process 12636: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:14,107 [root] INFO: Announced 64-bit process name: chrome.exe pid: 12636
2026-05-28 21:12:14,108 [lib.api.process] INFO: Monitor config for process 12636: C:\lpw_albt\dll\12636.ini
2026-05-28 21:12:14,109 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:14,111 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:14,118 [root] DEBUG: Loader: Injecting process 12636 (thread 12656) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:14,118 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:14,119 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:14,121 [lib.api.process] INFO: Injected into 64-bit <Process 12636 chrome.exe>
2026-05-28 21:12:14,123 [root] INFO: Announced 64-bit process name: chrome.exe pid: 12636
2026-05-28 21:12:14,123 [lib.api.process] INFO: Monitor config for process 12636: C:\lpw_albt\dll\12636.ini
2026-05-28 21:12:14,123 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:14,125 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:14,129 [root] DEBUG: Loader: Injecting process 12636 (thread 12656) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:14,129 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:12:14,131 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:14,132 [lib.api.process] INFO: Injected into 64-bit <Process 12636 chrome.exe>
2026-05-28 21:12:14,144 [root] DEBUG: 12636: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:14,145 [root] DEBUG: 12636: Interactive desktop enabled.
2026-05-28 21:12:14,147 [root] DEBUG: 12636: Dropped file limit defaulting to 100.
2026-05-28 21:12:14,153 [root] DEBUG: 12636: Chrome-specific hook-set enabled.
2026-05-28 21:12:14,154 [root] DEBUG: 12636: Disabling sleep skipping.
2026-05-28 21:12:14,155 [root] DEBUG: 12636: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:14,167 [root] DEBUG: 12636: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:14,167 [root] DEBUG: 12636: Monitor initialised: 64-bit capemon loaded in process 12636 at 0x00007FFF18240000, thread 12656, image base 0x00007FF7AD300000, stack from 0x000000AB95DF4000-0x000000AB95E00000
2026-05-28 21:12:14,168 [root] DEBUG: 12636: Commandline: "C:\Program Files\Google\Chrome\Application\chrome.exe"
2026-05-28 21:12:14,178 [root] DEBUG: 12636: Hooked 2 out of 2 functions
2026-05-28 21:12:14,203 [root] DEBUG: 12636: Syscall hook installed, syscall logging level 1
2026-05-28 21:12:14,208 [root] DEBUG: 12636: RestoreHeaders: Restored original import table.
2026-05-28 21:12:14,209 [root] INFO: Loaded monitor into process with pid 12636
2026-05-28 21:12:14,210 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 21:12:14,218 [root] DEBUG: 12636: InstrumentationCallback: Added region at 0x00007FFF13CB0014 (base 0x00007FFF13A00000) to tracked regions list (thread 12656).
2026-05-28 21:12:14,221 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,221 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56770000: C:\Windows\system32\ntmarta (0x33000 bytes).
2026-05-28 21:12:14,226 [root] DEBUG: 12636: caller_dispatch: Added region at 0x00007FF7AD300000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7AD3372AF, thread 12656).
2026-05-28 21:12:14,231 [root] DEBUG: 12636: ProcessImageBase: Main module image at 0x00007FF7AD300000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:12:14,236 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263357e+00 (from 6.263195e+00)
2026-05-28 21:12:14,237 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,242 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263357e+00 (from 6.263195e+00)
2026-05-28 21:12:14,242 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,244 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 21:12:14,244 [root] DEBUG: 12636: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 21:12:14,249 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263357e+00 (from 6.263195e+00)
2026-05-28 21:12:14,250 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,251 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 12248: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:14,251 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 12248
2026-05-28 21:12:14,256 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263357e+00 (from 6.263195e+00)
2026-05-28 21:12:14,259 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,260 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 12248
2026-05-28 21:12:14,311 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263583e+00 (from 6.263195e+00)
2026-05-28 21:12:14,312 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,333 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263580e+00 (from 6.263195e+00)
2026-05-28 21:12:14,335 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,339 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263582e+00 (from 6.263195e+00)
2026-05-28 21:12:14,340 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,345 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263581e+00 (from 6.263195e+00)
2026-05-28 21:12:14,346 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,351 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263582e+00 (from 6.263195e+00)
2026-05-28 21:12:14,352 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,353 [root] DEBUG: 12636: DLL loaded at 0x00007FFF453C0000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-28 21:12:14,354 [root] DEBUG: 12636: DLL loaded at 0x00007FFF49A90000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-28 21:12:14,355 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57350000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-28 21:12:14,355 [root] DEBUG: 12636: DLL loaded at 0x00007FFEEAF40000: C:\Program Files\Google\Chrome\Application\148.0.7778.217\chrome (0x10fdc000 bytes).
2026-05-28 21:12:14,361 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263581e+00 (from 6.263195e+00)
2026-05-28 21:12:14,361 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,367 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263582e+00 (from 6.263195e+00)
2026-05-28 21:12:14,368 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,368 [root] DEBUG: 12636: DLL loaded at 0x00007FFF45010000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-28 21:12:14,374 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263583e+00 (from 6.263195e+00)
2026-05-28 21:12:14,374 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,379 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263583e+00 (from 6.263195e+00)
2026-05-28 21:12:14,379 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,380 [root] DEBUG: 12636: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:12:14,388 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263582e+00 (from 6.263195e+00)
2026-05-28 21:12:14,389 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,389 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57520000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-28 21:12:14,393 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263583e+00 (from 6.263195e+00)
2026-05-28 21:12:14,394 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,395 [root] DEBUG: 12636: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 21:12:14,399 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263583e+00 (from 6.263195e+00)
2026-05-28 21:12:14,400 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,401 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-28 21:12:14,405 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263582e+00 (from 6.263195e+00)
2026-05-28 21:12:14,406 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,407 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-28 21:12:14,416 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263582e+00 (from 6.263195e+00)
2026-05-28 21:12:14,417 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,421 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263582e+00 (from 6.263195e+00)
2026-05-28 21:12:14,421 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,422 [root] DEBUG: 12636: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\netapi32 (0x19000 bytes).
2026-05-28 21:12:14,426 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263583e+00 (from 6.263195e+00)
2026-05-28 21:12:14,427 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,432 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263583e+00 (from 6.263195e+00)
2026-05-28 21:12:14,432 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,436 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,437 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,438 [root] DEBUG: 12636: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:14,438 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-28 21:12:14,439 [root] DEBUG: 12636: DLL loaded at 0x00007FFF52F20000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 21:12:14,446 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,447 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,447 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57560000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-28 21:12:14,453 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,454 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,458 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,459 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,463 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,463 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,468 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,468 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,473 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263573e+00 (from 6.263195e+00)
2026-05-28 21:12:14,474 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263573e+00 (from 6.263195e+00)
2026-05-28 21:12:14,475 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,477 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,477 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263573e+00 (from 6.263195e+00)
2026-05-28 21:12:14,478 [root] DEBUG: 12636: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 21:12:14,479 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,482 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,482 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,483 [root] DEBUG: 12636: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:12:14,487 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,488 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,489 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:12:14,493 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,494 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,495 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:12:14,499 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,499 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,502 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,503 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,503 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,506 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,507 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,508 [root] DEBUG: 12636: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:12:14,508 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,508 [root] DEBUG: 12636: DLL loaded at 0x00007FFF3FB00000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-28 21:12:14,513 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263574e+00 (from 6.263195e+00)
2026-05-28 21:12:14,513 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263574e+00 (from 6.263195e+00)
2026-05-28 21:12:14,514 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,514 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,518 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263574e+00 (from 6.263195e+00)
2026-05-28 21:12:14,519 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263574e+00 (from 6.263195e+00)
2026-05-28 21:12:14,519 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,520 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,524 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263574e+00 (from 6.263195e+00)
2026-05-28 21:12:14,525 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,529 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263573e+00 (from 6.263195e+00)
2026-05-28 21:12:14,530 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,534 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263574e+00 (from 6.263195e+00)
2026-05-28 21:12:14,534 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,539 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263574e+00 (from 6.263195e+00)
2026-05-28 21:12:14,540 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,541 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 21:12:14,541 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57010000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 21:12:14,542 [root] DEBUG: 12636: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:12:14,543 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 21:12:14,543 [root] DEBUG: 12636: DLL loaded at 0x00007FFF15300000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-28 21:12:14,544 [root] DEBUG: 12636: DLL loaded at 0x00007FFF3F9B0000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-28 21:12:14,548 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263574e+00 (from 6.263195e+00)
2026-05-28 21:12:14,548 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,549 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56FD0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 21:12:14,556 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263573e+00 (from 6.263195e+00)
2026-05-28 21:12:14,556 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,557 [root] DEBUG: 12636: DLL loaded at 0x00007FFF44D50000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-28 21:12:14,561 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,561 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,566 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,567 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,569 [root] DEBUG: 12636: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\netapi32 (0x19000 bytes).
2026-05-28 21:12:14,573 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263569e+00 (from 6.263195e+00)
2026-05-28 21:12:14,573 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,577 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,578 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,579 [root] DEBUG: 12636: DLL loaded at 0x00007FFF569F0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-28 21:12:14,579 [root] DEBUG: 12636: DLL loaded at 0x00007FFF52960000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-28 21:12:14,585 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,586 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,587 [root] DEBUG: 12636: DLL loaded at 0x00007FFF48330000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-28 21:12:14,591 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,592 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,593 [root] DEBUG: 12636: DLL loaded at 0x00007FFF58B20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 21:12:14,597 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263572e+00 (from 6.263195e+00)
2026-05-28 21:12:14,599 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,600 [root] DEBUG: 12636: DLL loaded at 0x00007FFF515C0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 21:12:14,605 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263571e+00 (from 6.263195e+00)
2026-05-28 21:12:14,605 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,606 [root] DEBUG: 12636: DLL loaded at 0x00007FFF515A0000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 21:12:14,610 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263576e+00 (from 6.263195e+00)
2026-05-28 21:12:14,610 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,612 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56A40000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 21:12:14,618 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,618 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,622 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,623 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,628 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,630 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,636 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,636 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,643 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,643 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,645 [root] DEBUG: 12636: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:12:14,650 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263576e+00 (from 6.263195e+00)
2026-05-28 21:12:14,650 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,655 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263576e+00 (from 6.263195e+00)
2026-05-28 21:12:14,655 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,661 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263576e+00 (from 6.263195e+00)
2026-05-28 21:12:14,661 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,666 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,666 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,670 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,671 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,675 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,676 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,677 [root] DEBUG: 12636: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 21:12:14,677 [root] DEBUG: 12636: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 21:12:14,679 [root] DEBUG: 12636: DLL loaded at 0x00007FFF54170000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 21:12:14,680 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4B680000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-28 21:12:14,686 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263577e+00 (from 6.263195e+00)
2026-05-28 21:12:14,687 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,688 [root] DEBUG: 12636: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 21:12:14,693 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263579e+00 (from 6.263195e+00)
2026-05-28 21:12:14,695 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,696 [root] DEBUG: 12636: DLL loaded at 0x00007FFF45580000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-28 21:12:14,700 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263579e+00 (from 6.263195e+00)
2026-05-28 21:12:14,701 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,706 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263576e+00 (from 6.263195e+00)
2026-05-28 21:12:14,707 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,712 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263576e+00 (from 6.263195e+00)
2026-05-28 21:12:14,713 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,717 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263576e+00 (from 6.263195e+00)
2026-05-28 21:12:14,718 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,725 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263576e+00 (from 6.263195e+00)
2026-05-28 21:12:14,726 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,727 [root] DEBUG: 12636: DLL loaded at 0x00007FFF52420000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-28 21:12:14,731 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,732 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,738 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,739 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,744 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263578e+00 (from 6.263195e+00)
2026-05-28 21:12:14,744 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,748 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,749 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,756 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,757 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,758 [root] DEBUG: 12636: DLL loaded at 0x00007FFF51A60000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 21:12:14,758 [root] DEBUG: 12636: DLL loaded at 0x00007FFF52860000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-05-28 21:12:14,759 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4AF10000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 21:12:14,760 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4BFB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 21:12:14,766 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,767 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,767 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,768 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,768 [root] DEBUG: 12636: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-28 21:12:14,773 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,774 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,774 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,775 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,779 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,780 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,780 [root] DEBUG: 12636: DLL loaded at 0x00007FFF515E0000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-28 21:12:14,781 [root] DEBUG: 12636: DLL loaded at 0x00007FFF51600000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-28 21:12:14,786 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,786 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,787 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263591e+00 (from 6.263195e+00)
2026-05-28 21:12:14,787 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,789 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,789 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,790 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 21:12:14,792 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,793 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,794 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,795 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,796 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,796 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 13828: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:14,797 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,797 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 13828
2026-05-28 21:12:14,800 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,801 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,801 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,802 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,802 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,804 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,804 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 13828
2026-05-28 21:12:14,805 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,805 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,806 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,807 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,808 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 21:12:14,808 [root] DEBUG: 12636: DLL loaded at 0x00007FFF572F0000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-05-28 21:12:14,809 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,809 [root] DEBUG: 12636: DLL loaded at 0x00007FFF50520000: C:\Windows\System32\MMDevApi (0x85000 bytes).
2026-05-28 21:12:14,810 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263593e+00 (from 6.263195e+00)
2026-05-28 21:12:14,810 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,811 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,815 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263602e+00 (from 6.263195e+00)
2026-05-28 21:12:14,816 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263602e+00 (from 6.263195e+00)
2026-05-28 21:12:14,816 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,817 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263602e+00 (from 6.263195e+00)
2026-05-28 21:12:14,817 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,822 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,825 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263602e+00 (from 6.263195e+00)
2026-05-28 21:12:14,825 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 13984: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:14,827 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,828 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 13984
2026-05-28 21:12:14,829 [root] DEBUG: 12636: DLL loaded at 0x00007FFF52560000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-28 21:12:14,831 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263603e+00 (from 6.263195e+00)
2026-05-28 21:12:14,831 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,832 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263603e+00 (from 6.263195e+00)
2026-05-28 21:12:14,832 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,833 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 13984
2026-05-28 21:12:14,837 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263603e+00 (from 6.263195e+00)
2026-05-28 21:12:14,843 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,843 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263603e+00 (from 6.263195e+00)
2026-05-28 21:12:14,844 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,846 [root] DEBUG: 12636: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 21:12:14,852 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263606e+00 (from 6.263195e+00)
2026-05-28 21:12:14,852 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263606e+00 (from 6.263195e+00)
2026-05-28 21:12:14,853 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,853 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,854 [root] DEBUG: 12636: DLL loaded at 0x00007FFF49D10000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 21:12:14,857 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,858 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,859 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,859 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,867 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,867 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,868 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,868 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,871 [root] DEBUG: 12636: DLL loaded at 0x00007FFF3E560000: C:\Windows\System32\CapabilityAccessManagerClient (0x3f000 bytes).
2026-05-28 21:12:14,873 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,873 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 14236: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:14,873 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,874 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,874 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 14236
2026-05-28 21:12:14,879 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,880 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,884 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,886 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,886 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,889 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,893 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:14,893 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,895 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,895 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,895 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,896 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,898 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,899 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 14236
2026-05-28 21:12:14,900 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,904 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,904 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,904 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,905 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,905 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,909 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,910 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,910 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,911 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,911 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,912 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,914 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,915 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,916 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,917 [root] DEBUG: 12636: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 21:12:14,917 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,918 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,918 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,919 [root] DEBUG: 12636: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 21:12:14,920 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,920 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,921 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,921 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,922 [root] DEBUG: 12636: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 21:12:14,927 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,927 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,930 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,930 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:14,931 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,931 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,931 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,932 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,933 [root] DEBUG: 12636: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 21:12:14,939 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:14,939 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:14,940 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,941 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,941 [root] DEBUG: 12636: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 21:12:14,947 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:14,947 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:14,948 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,948 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,949 [root] DEBUG: 12636: DLL loaded at 0x00007FFF19960000: C:\Windows\System32\CryptoWinRT (0x61000 bytes).
2026-05-28 21:12:14,952 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:14,953 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,954 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:14,954 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,956 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4F6E0000: C:\Windows\System32\usermgrproxy (0x54000 bytes).
2026-05-28 21:12:14,958 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,959 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,962 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,962 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,962 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,963 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,963 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,967 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,967 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,967 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,968 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,968 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,971 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:14,972 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,972 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:14,973 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,974 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:14,976 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,977 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,977 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,980 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,980 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,981 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,981 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,982 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:14,982 [root] DEBUG: 12636: DLL loaded at 0x00007FFF55EF0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-28 21:12:14,983 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,983 [root] DEBUG: 12636: DLL loaded at 0x00007FFF53070000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-28 21:12:14,984 [root] DEBUG: 12636: DLL loaded at 0x00007FFF538A0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-28 21:12:14,985 [root] DEBUG: 12636: DLL loaded at 0x00007FFF43630000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-28 21:12:14,989 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:14,990 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,992 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:14,992 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:14,993 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,993 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,994 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56250000: C:\Windows\System32\FirewallAPI (0x96000 bytes).
2026-05-28 21:12:14,997 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:14,997 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,998 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:14,998 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:14,999 [root] DEBUG: 12636: DLL loaded at 0x00007FFF561E0000: C:\Windows\System32\fwbase (0x36000 bytes).
2026-05-28 21:12:15,002 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:15,002 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,003 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:15,004 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,009 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:15,009 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,010 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57010000: C:\Windows\System32\ncrypt (0x27000 bytes).
2026-05-28 21:12:15,011 [root] DEBUG: 12636: DLL loaded at 0x00007FFF51040000: C:\Windows\System32\cryptngc (0x77000 bytes).
2026-05-28 21:12:15,016 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,017 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,017 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56FD0000: C:\Windows\System32\NTASN1 (0x3b000 bytes).
2026-05-28 21:12:15,023 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,023 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,024 [root] DEBUG: 12636: DLL loaded at 0x00007FFF43590000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-28 21:12:15,026 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,026 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,028 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,029 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,030 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,030 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,032 [root] DEBUG: 12636: DLL loaded at 0x00007FFF19930000: C:\Windows\system32\ngcksp (0x27000 bytes).
2026-05-28 21:12:15,033 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,033 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,036 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,036 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,037 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,039 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,039 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,040 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,040 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,041 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,042 [root] DEBUG: 12636: DLL loaded at 0x00007FFF55220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-28 21:12:15,047 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,048 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,049 [root] DEBUG: 12636: DLL loaded at 0x00007FFF1EF30000: C:\Windows\System32\Windows.Media (0x726000 bytes).
2026-05-28 21:12:15,053 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,054 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,058 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,059 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,063 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,063 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,064 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,064 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,067 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 14908: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:15,067 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 14908
2026-05-28 21:12:15,070 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,070 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,071 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,071 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,072 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,072 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,073 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 14944: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:15,073 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 14908
2026-05-28 21:12:15,073 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 14944
2026-05-28 21:12:15,075 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,076 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,076 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,077 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,078 [root] DEBUG: 12636: DLL loaded at 0x00007FFF43990000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-28 21:12:15,078 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,079 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,079 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,080 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,080 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 14944
2026-05-28 21:12:15,081 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,082 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,084 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,085 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,086 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,087 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,087 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,088 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,091 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,091 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,092 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,092 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,092 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263629e+00 (from 6.263195e+00)
2026-05-28 21:12:15,095 [root] DEBUG: 12636: DLL loaded at 0x00007FFF488B0000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-28 21:12:15,096 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,097 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:15,104 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,104 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,105 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,106 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,106 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,111 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,113 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,113 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,118 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,128 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,139 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,141 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,142 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,142 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,142 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,145 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,146 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,147 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,147 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,148 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,148 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,149 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,149 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,150 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,157 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,160 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 15268: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:15,160 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,160 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,163 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,164 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,166 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,166 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,167 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,168 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 15268
2026-05-28 21:12:15,170 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,171 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,172 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,173 [root] DEBUG: 12636: DLL loaded at 0x00007FFF42E10000: C:\Windows\system32\explorerframe (0x244000 bytes).
2026-05-28 21:12:15,173 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,177 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,179 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,180 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,180 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,181 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,181 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,182 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,182 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,182 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,183 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,184 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 15268
2026-05-28 21:12:15,184 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,185 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,185 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,185 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,189 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,190 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4F950000: C:\Windows\system32\wlanapi (0x74000 bytes).
2026-05-28 21:12:15,190 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,193 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,194 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,196 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,200 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,201 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,201 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,206 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,207 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,209 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,210 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,210 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,212 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,213 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,221 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,225 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,243 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,244 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,252 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,256 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,257 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,258 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,258 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,261 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,261 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:15,263 [root] DEBUG: 12636: DLL loaded at 0x00007FFF457F0000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-28 21:12:15,264 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,264 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,265 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,266 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,268 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,271 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,271 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,272 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,273 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,273 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,274 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57130000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 21:12:15,275 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,278 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,279 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,279 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,280 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,286 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,286 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,286 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,287 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,288 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,288 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,294 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,295 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,296 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,299 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,300 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,301 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,301 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,301 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,303 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,304 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,305 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,306 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,306 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,307 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,308 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,308 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,309 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,310 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,311 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,315 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263634e+00 (from 6.263195e+00)
2026-05-28 21:12:15,316 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,317 [root] DEBUG: 12636: DLL loaded at 0x00007FFF48B40000: C:\Windows\System32\WININET (0x4d6000 bytes).
2026-05-28 21:12:15,317 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,318 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,321 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,323 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,324 [root] DEBUG: 12636: DLL loaded at 0x00007FFF3D6A0000: C:\Windows\System32\windows.internal.shell.broker (0xdd000 bytes).
2026-05-28 21:12:15,324 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,330 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,331 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,332 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,332 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,332 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,333 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,334 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,334 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,335 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,336 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,339 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 21:12:15,339 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,341 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,341 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,343 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,344 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,344 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,345 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,346 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,346 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,348 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,356 [root] DEBUG: 12636: DLL loaded at 0x00007FFF48780000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 21:12:15,356 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,359 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,362 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,363 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,372 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,377 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56630000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-28 21:12:15,378 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,377 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,380 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,382 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,383 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,384 [root] DEBUG: 12636: DLL loaded at 0x00007FFF43060000: C:\Windows\System32\PCShellCommonProxyStub (0x13000 bytes).
2026-05-28 21:12:15,384 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263633e+00 (from 6.263195e+00)
2026-05-28 21:12:15,385 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,389 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,390 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,394 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,395 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,399 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,400 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,404 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,404 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,409 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,409 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,413 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,414 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,418 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,419 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,423 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,423 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,428 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,429 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,433 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,434 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,438 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,438 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,442 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,443 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,447 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,448 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,452 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,453 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,457 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,457 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,461 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,462 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,466 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,467 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,471 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,472 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,476 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,477 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,482 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,482 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,487 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,488 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,492 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,493 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,497 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,498 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,502 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:15,502 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:15,528 [lib.api.process] INFO: Monitor config for process 832: C:\lpw_albt\dll\832.ini
2026-05-28 21:12:15,530 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:15,532 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:15,536 [root] DEBUG: Loader: Injecting process 832 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:15,538 [root] DEBUG: 832: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:15,539 [root] DEBUG: 832: Disabling sleep skipping.
2026-05-28 21:12:15,539 [root] DEBUG: 832: Interactive desktop enabled.
2026-05-28 21:12:15,540 [root] DEBUG: 832: Dropped file limit defaulting to 100.
2026-05-28 21:12:15,549 [root] DEBUG: 832: Services hook set enabled
2026-05-28 21:12:15,551 [root] DEBUG: 832: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:15,562 [root] DEBUG: 832: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:15,563 [root] DEBUG: 832: Monitor initialised: 64-bit capemon loaded in process 832 at 0x00007FFF18240000, thread 16348, image base 0x00007FF7BF220000, stack from 0x000000CCA7B74000-0x000000CCA7B80000
2026-05-28 21:12:15,563 [root] DEBUG: 832: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p
2026-05-28 21:12:15,576 [root] DEBUG: 832: Hooked 69 out of 69 functions
2026-05-28 21:12:15,577 [root] INFO: Loaded monitor into process with pid 832
2026-05-28 21:12:15,578 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 21:12:15,578 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:15,580 [lib.api.process] INFO: Injected into 64-bit <Process 832 svchost.exe>
2026-05-28 21:12:17,598 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,598 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,599 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,600 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,600 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,601 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,604 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,605 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,606 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,607 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,608 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,608 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,608 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,609 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,610 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,611 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,612 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,613 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,620 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,621 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,626 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,627 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,639 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,641 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,647 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,648 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,653 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,654 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,658 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,659 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,663 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,664 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,669 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,670 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,678 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,681 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,686 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,688 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,694 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,695 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,700 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,701 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,707 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,708 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,714 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,715 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,720 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,721 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,726 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,727 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,732 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,733 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,737 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,738 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,739 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,740 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,742 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,743 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,749 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,750 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,750 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,751 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,755 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,755 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,756 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,756 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,760 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 16808: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:17,761 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,762 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 16808
2026-05-28 21:12:17,762 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,764 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,766 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,767 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,767 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,767 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,770 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,770 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,771 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,771 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,772 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 16808
2026-05-28 21:12:17,772 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,773 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,776 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,777 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,778 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,778 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,778 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,779 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,779 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,792 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,792 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,793 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,794 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,795 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,795 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,796 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,797 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,798 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,796 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,803 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,804 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,805 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,805 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,805 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,806 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,806 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,807 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,810 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,811 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,811 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,811 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,816 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,817 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,818 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,818 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,819 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,819 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,820 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,820 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,823 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,824 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,824 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,825 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,825 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,825 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,828 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,829 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,830 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,831 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,831 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,833 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,835 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,839 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,842 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,843 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,843 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,844 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,848 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,849 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,855 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,856 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,860 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,861 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,864 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,866 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,867 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,868 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,870 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,871 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,875 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,875 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,879 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,881 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,924 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,925 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,931 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,932 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,936 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,936 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,938 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,938 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,953 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,953 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,975 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,976 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,981 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,982 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:17,992 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:17,993 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,003 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,003 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,008 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,009 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,011 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,011 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,014 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,016 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,017 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,018 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,021 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,022 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,030 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,031 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,032 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,032 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,033 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,034 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,037 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,037 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,038 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,040 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,040 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,041 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,046 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,047 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,053 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,054 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,061 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,063 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,063 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,064 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,064 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,065 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,069 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,069 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,070 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,070 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,071 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,072 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,078 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,079 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,086 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,087 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,099 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,100 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,100 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,100 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,104 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,105 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,106 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,106 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,111 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,112 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,121 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,122 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,129 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,130 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,133 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,134 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,135 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,135 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,141 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,142 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,174 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,176 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,181 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,182 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,202 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,203 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,209 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,210 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,216 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,217 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,222 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,223 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,400 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,401 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,757 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,758 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,876 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,877 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,887 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,888 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,900 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,901 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,905 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,905 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,910 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,911 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,915 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,916 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,920 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,920 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,924 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,925 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,932 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,932 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,939 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,939 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,944 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,945 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,949 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,949 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,956 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,956 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,960 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,961 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,968 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,969 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,974 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,975 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,980 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,981 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:18,985 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:18,986 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,041 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,042 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,047 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,048 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,052 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,053 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,057 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,058 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,111 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,112 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,117 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,118 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,122 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,123 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,127 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,128 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,132 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,133 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,138 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,139 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,144 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,145 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,293 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,294 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,306 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,306 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,310 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,311 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,315 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,316 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,320 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,320 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,324 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,325 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,329 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,330 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,334 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,335 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,339 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,339 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,345 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,350 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,350 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,350 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,351 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,352 [root] DEBUG: 12636: DLL loaded at 0x00007FFF41D40000: C:\Windows\SYSTEM32\pdh (0x49000 bytes).
2026-05-28 21:12:19,356 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,358 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263631e+00 (from 6.263195e+00)
2026-05-28 21:12:19,358 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,359 [root] DEBUG: 12636: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\SETUPAPI (0x46e000 bytes).
2026-05-28 21:12:19,363 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:19,364 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:19,364 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263630e+00 (from 6.263195e+00)
2026-05-28 21:12:19,365 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,365 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,366 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,366 [root] DEBUG: 12636: DLL loaded at 0x00007FFF54B30000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-05-28 21:12:19,369 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,370 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,372 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,373 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,373 [root] DEBUG: 12636: DLL loaded at 0x00007FFF47420000: C:\Windows\System32\Windows.FileExplorer.Common (0x61000 bytes).
2026-05-28 21:12:19,376 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,377 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,381 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,381 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,382 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,383 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,383 [root] DEBUG: 12636: DLL loaded at 0x00007FFF57AA0000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 21:12:19,387 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,388 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,388 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,389 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,390 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,391 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4F560000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-05-28 21:12:19,391 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,395 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,395 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,396 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,396 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,397 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,398 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4D6A0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 21:12:19,398 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,400 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,401 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,404 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,405 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,406 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,407 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,411 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,413 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,416 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,417 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,418 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,418 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,419 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,419 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,422 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,423 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,424 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,424 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,425 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,425 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,427 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,429 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,430 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,431 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,432 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,433 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,433 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,434 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,436 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,436 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,438 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,441 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,442 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,442 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,444 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,445 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,448 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,449 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,449 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263632e+00 (from 6.263195e+00)
2026-05-28 21:12:19,450 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,454 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,455 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,455 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,456 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,461 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,462 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,463 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,464 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,467 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,467 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,468 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,469 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,471 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,472 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,472 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,473 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,474 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,476 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,480 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,480 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,481 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,482 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,482 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,484 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,485 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,485 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,486 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,486 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,487 [root] DEBUG: 12636: DLL loaded at 0x00007FFEE7D30000: C:\Program Files\Google\Chrome\Application\148.0.7778.217\optimization_guide_internal (0x11e2000 bytes).
2026-05-28 21:12:19,488 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,488 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,491 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,492 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,492 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,492 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,493 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,494 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,496 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,497 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,498 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,499 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,499 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,500 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,501 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,502 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,502 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,503 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,504 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,504 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,505 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,506 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,507 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,508 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,512 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 18452: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:19,512 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,512 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,513 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 18452
2026-05-28 21:12:19,514 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,514 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,517 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,518 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: ume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,519 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,519 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 18452
2026-05-28 21:12:19,520 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,521 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,521 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,524 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,525 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,525 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,530 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,531 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,532 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,535 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,536 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,537 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,544 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 18548: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:19,544 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,545 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,545 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 18548
2026-05-28 21:12:19,546 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,546 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,547 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,548 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,549 [root] DEBUG: 12636: DLL loaded at 0x00007FFF56D00000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-05-28 21:12:19,550 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,550 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,553 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,553 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,554 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,554 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 18548
2026-05-28 21:12:19,555 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,555 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,558 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,559 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,561 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,562 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,563 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,565 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,565 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,568 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,570 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,570 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,570 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,571 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,578 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,578 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,579 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,579 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,580 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,583 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,584 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,585 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,587 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,589 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,590 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,591 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,592 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,593 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,595 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,596 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,600 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,600 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,601 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,602 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,606 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,608 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,610 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,612 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,613 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,616 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,616 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,617 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,618 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,618 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,622 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,623 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,628 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,630 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,636 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,637 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,637 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 18964: C:\Windows\system32\wbem\wmiprvse.exe, ImageBase: 0x00007FF7BB740000
2026-05-28 21:12:19,638 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,639 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,643 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 18964
2026-05-28 21:12:19,644 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,644 [lib.api.process] INFO: Monitor config for process 18964: C:\lpw_albt\dll\18964.ini
2026-05-28 21:12:19,645 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,647 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:19,648 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,648 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,649 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,649 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,650 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,651 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,653 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,654 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,656 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,658 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,659 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,659 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,660 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,661 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,665 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,666 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,666 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,666 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,667 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,670 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,671 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,671 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,672 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,673 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,674 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,674 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,675 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,677 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,679 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,679 [root] DEBUG: 12636: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:12:19,680 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,681 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4FA10000: C:\Windows\system32\tbs (0x1b000 bytes).
2026-05-28 21:12:19,684 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,685 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,685 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,686 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,690 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,690 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,692 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,691 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,693 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,693 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,695 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,695 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,697 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,697 [root] DEBUG: 12636: DLL loaded at 0x00007FFF50370000: C:\Windows\system32\PCPKsp (0x118000 bytes).
2026-05-28 21:12:19,699 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,702 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,703 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,703 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,704 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,705 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,705 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,708 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,709 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,709 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,710 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,711 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,712 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,712 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,712 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,714 [root] DEBUG: 12636: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:12:19,716 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 21:12:19,717 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,717 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,722 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,723 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,725 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,725 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,726 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,727 [root] DEBUG: 12636: DLL loaded at 0x00007FFF45050000: C:\Windows\system32\ncryptprov (0x5a000 bytes).
2026-05-28 21:12:19,727 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,729 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,730 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,735 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,735 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,736 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,737 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,740 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,741 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,744 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,745 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,745 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,746 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,747 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,748 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,751 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,751 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,753 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,754 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,757 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,758 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,763 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,764 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,764 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,765 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,766 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,767 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,767 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,769 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,770 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,771 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,772 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,773 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,775 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,776 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,780 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,781 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,783 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,784 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,788 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,789 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,789 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,789 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,792 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,793 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,794 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,795 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,795 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,796 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,798 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,799 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,800 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,801 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,803 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,803 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,804 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,804 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,806 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,806 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,808 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,809 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,809 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,810 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,811 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,812 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,816 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,817 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,818 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,819 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,819 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,820 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,822 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,823 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,824 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,825 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,825 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,826 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,827 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,828 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,832 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,834 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,835 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,836 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,836 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,836 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,840 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,841 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,841 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,842 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,842 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,843 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,847 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,848 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,849 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,850 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,850 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,851 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,853 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,854 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,854 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,855 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,857 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,858 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,859 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,859 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,863 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,865 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,865 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,866 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,867 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,867 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,870 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,870 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,871 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,872 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,873 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,874 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,878 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,879 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,882 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,883 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,883 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,883 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,884 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,885 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,890 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,891 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,893 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,894 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,899 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,899 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,900 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,900 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,901 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,901 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,905 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,906 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,906 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,907 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,908 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,908 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,911 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,911 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,914 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,914 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,915 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,916 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,917 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,917 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,920 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,921 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,921 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,922 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,925 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,925 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,927 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,928 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,929 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,929 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,932 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,932 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,933 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,933 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,935 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,936 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,938 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,938 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,939 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,940 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,941 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,941 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,943 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,944 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,946 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,947 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,948 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,948 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,950 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,950 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,951 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,952 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,955 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,956 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,956 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,958 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,958 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,961 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,963 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,964 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,966 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,967 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,967 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,968 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,969 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,970 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,971 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,972 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,975 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,976 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,977 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,977 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,979 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,980 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,982 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,983 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,983 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,984 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,984 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,985 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,989 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,990 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,992 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,993 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,993 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,994 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,996 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,996 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:19,998 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:19,998 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,001 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,002 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,003 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,006 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,007 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,007 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,008 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,009 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,013 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,014 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,014 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,015 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,016 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,016 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,022 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,023 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,025 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,027 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,027 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,029 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,029 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,030 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,031 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,032 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,037 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,039 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,039 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,040 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,046 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,046 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,047 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,048 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,049 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,049 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,057 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,058 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,061 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,062 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,064 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,065 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,068 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,069 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,071 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,072 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,079 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,079 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,080 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,081 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,087 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,087 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,088 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,089 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,099 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,100 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,101 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,101 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,107 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,108 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,108 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,109 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,114 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,115 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,115 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,116 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,120 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,121 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,124 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,124 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,129 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,130 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,132 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,135 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,136 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,136 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,137 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,139 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,140 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,141 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,142 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,143 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,147 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,148 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,149 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,149 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,154 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,155 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,155 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,156 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,156 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,157 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,160 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,160 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,162 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,166 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,167 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,168 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,170 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,171 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,172 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,172 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,174 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,175 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,176 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,176 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,177 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,179 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,181 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,182 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,183 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,183 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,185 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,186 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,188 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,188 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,189 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,190 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,192 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,193 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,195 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,196 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,198 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,198 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,199 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,200 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,201 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,201 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,204 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,204 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,206 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,206 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,207 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,208 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,212 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,212 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,215 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,215 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,217 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,218 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,221 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,222 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,223 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,223 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,224 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,225 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,230 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,231 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,234 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,235 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,235 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,236 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,240 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,241 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,242 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,242 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,245 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,246 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,247 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,247 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,248 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,249 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,251 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,252 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,254 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,255 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,259 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,259 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,260 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,260 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,264 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,265 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,266 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,267 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,267 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,269 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,270 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,270 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,274 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,275 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,277 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,278 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,282 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,284 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,285 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,286 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,289 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,289 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,292 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,293 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,293 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,295 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,296 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,296 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,298 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,299 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,305 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,305 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,306 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,306 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,311 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,311 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,312 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,313 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,316 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,317 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,319 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,321 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,322 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,323 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,326 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,327 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,328 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,329 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,332 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,332 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,334 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,334 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,337 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,337 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,339 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,340 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,347 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,348 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,348 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,350 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,351 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,353 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,354 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,355 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,361 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,361 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,362 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,362 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,364 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,364 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,368 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,369 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,369 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,370 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,370 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,371 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,373 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,374 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,374 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,375 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,376 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,377 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,381 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,381 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,382 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,382 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,383 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,383 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,386 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,386 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,387 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,388 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,388 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,389 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,392 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,393 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,393 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,394 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,394 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,395 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,398 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,399 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,399 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,399 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,402 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,403 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,403 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,403 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,404 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,404 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,409 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,411 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,411 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,412 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,414 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,415 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,416 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,417 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,417 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,418 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,419 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,419 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,422 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,423 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,423 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,424 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,428 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,429 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,429 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,430 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,434 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,434 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,434 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,435 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,438 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,439 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,440 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,440 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,443 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,444 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,445 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,446 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,448 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,448 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,451 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,452 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,452 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,453 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,457 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,458 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,460 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,461 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,462 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,463 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,467 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,468 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,472 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,473 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,477 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,477 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,483 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,484 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,485 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,485 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,489 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,490 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,491 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,491 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,495 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,496 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,500 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,500 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,501 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,501 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,506 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,507 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,508 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,509 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,511 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,512 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,516 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,517 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,522 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,522 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,526 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,527 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,531 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,532 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,532 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,533 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,537 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,538 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,542 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,543 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,547 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,548 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,552 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,553 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,557 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,558 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,561 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,562 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,566 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,568 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,572 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,573 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,574 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,575 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,577 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,577 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,580 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,580 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,581 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,582 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,585 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,585 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,587 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,588 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 21712: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:20,588 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,589 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 21712
2026-05-28 21:12:20,593 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,593 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,595 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,595 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,597 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 21712
2026-05-28 21:12:20,597 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,598 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,600 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,600 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,601 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,602 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,602 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,603 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,603 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,606 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,607 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,607 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,608 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,609 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,613 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,615 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,615 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,617 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,617 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,617 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,622 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,622 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,623 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,623 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,627 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,628 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,629 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,629 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,634 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,634 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,634 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,636 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,641 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,642 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,642 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,644 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,649 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,649 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,655 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,656 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,656 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,657 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,662 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,664 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,667 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,668 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,669 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,670 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,673 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,674 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,675 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,676 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,681 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,681 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,690 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,691 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,695 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,696 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,701 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,701 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,706 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,708 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,713 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,714 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,718 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,719 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,724 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,724 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,729 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,730 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,734 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,735 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,739 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,740 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,744 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,745 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,749 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,750 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,755 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,756 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,761 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,762 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,768 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,769 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,774 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,775 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,780 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,781 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,781 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,782 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,786 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,788 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,793 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,794 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,798 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,799 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,799 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:20,803 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,804 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,804 [root] DEBUG: Loader: Injecting process 18964 (thread 18968) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:20,805 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,805 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:20,806 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,806 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:20,808 [lib.api.process] INFO: Injected into 64-bit <Process 18964 WmiPrvSE.exe>
2026-05-28 21:12:20,808 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,809 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,809 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 18964
2026-05-28 21:12:20,810 [lib.api.process] INFO: Monitor config for process 18964: C:\lpw_albt\dll\18964.ini
2026-05-28 21:12:20,810 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:20,812 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,812 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,813 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,814 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,818 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,819 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,823 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,824 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,828 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,829 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,833 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,834 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,838 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,839 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,842 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,843 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,843 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,844 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,849 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,849 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,854 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,854 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,858 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,859 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,863 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,864 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,869 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,870 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,874 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,874 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,878 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,879 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,883 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,884 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,888 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,889 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,893 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,894 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,895 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,896 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,898 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,899 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,903 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,903 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,908 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,908 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,912 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,913 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,917 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,917 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,921 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,922 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,927 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,927 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,932 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,932 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,936 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,937 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,942 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,943 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,947 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,947 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,952 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,952 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,957 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,957 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,961 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,962 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,963 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,964 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,966 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,967 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,972 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,973 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,974 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,975 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,977 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,978 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,982 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,983 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,987 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,988 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,992 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,993 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,997 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,998 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:20,998 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:20,999 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,003 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,003 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,004 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,005 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,008 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,009 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,014 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,014 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,019 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,021 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,025 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,026 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,031 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,032 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,037 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,038 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,042 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,043 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,048 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,048 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,053 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,054 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,058 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,059 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,066 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,067 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,074 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,075 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,080 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,085 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,086 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,092 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,094 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,096 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,100 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,101 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,101 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,102 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,108 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,114 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,122 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,124 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,124 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,125 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,126 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,127 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,131 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,136 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,142 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,145 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,149 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:21,153 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,154 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,159 [root] DEBUG: Loader: Injecting process 18964 (thread 18968) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:21,160 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,166 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:12:21,167 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,171 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:21,172 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,173 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,173 [lib.api.process] INFO: Injected into 64-bit <Process 18964 WmiPrvSE.exe>
2026-05-28 21:12:21,183 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,184 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,185 [root] DEBUG: 18964: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:21,186 [root] DEBUG: 18964: Interactive desktop enabled.
2026-05-28 21:12:21,187 [root] DEBUG: 18964: Dropped file limit defaulting to 100.
2026-05-28 21:12:21,189 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,193 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,195 [root] DEBUG: 18964: Disabling sleep skipping.
2026-05-28 21:12:21,196 [root] DEBUG: 18964: Services hook set enabled
2026-05-28 21:12:21,198 [root] DEBUG: 18964: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:21,199 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,200 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,207 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,210 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,212 [root] DEBUG: 18964: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:21,212 [root] DEBUG: 18964: Monitor initialised: 64-bit capemon loaded in process 18964 at 0x00007FFF18240000, thread 18968, image base 0x00007FF7BB740000, stack from 0x000000311FCA0000-0x000000311FCB0000
2026-05-28 21:12:21,213 [root] DEBUG: 18964: Commandline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
2026-05-28 21:12:21,216 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,217 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,221 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,226 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,226 [root] DEBUG: 18964: Hooked 69 out of 69 functions
2026-05-28 21:12:21,231 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,232 [root] DEBUG: 18964: RestoreHeaders: Restored original import table.
2026-05-28 21:12:21,232 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,233 [root] INFO: Loaded monitor into process with pid 18964
2026-05-28 21:12:21,237 [root] DEBUG: 18964: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:12:21,238 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,239 [root] DEBUG: 18964: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 21:12:21,239 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,240 [root] DEBUG: 18964: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:12:21,243 [lib.api.process] INFO: Monitor config for process 8060: C:\lpw_albt\dll\8060.ini
2026-05-28 21:12:21,244 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,245 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,245 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:21,248 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:21,248 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,252 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,254 [root] DEBUG: Loader: Injecting process 8060 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:21,254 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,255 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,259 [root] DEBUG: 8060: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:21,260 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,260 [root] DEBUG: 8060: Disabling sleep skipping.
2026-05-28 21:12:21,261 [root] DEBUG: 8060: Interactive desktop enabled.
2026-05-28 21:12:21,262 [root] DEBUG: 8060: Dropped file limit defaulting to 100.
2026-05-28 21:12:21,262 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,263 [root] DEBUG: 8060: Services hook set enabled
2026-05-28 21:12:21,267 [root] DEBUG: 8060: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:21,267 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,268 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,281 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,282 [root] DEBUG: 8060: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:21,282 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,283 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,283 [root] DEBUG: 8060: Monitor initialised: 64-bit capemon loaded in process 8060 at 0x00007FFF18240000, thread 23068, image base 0x00007FF7BF220000, stack from 0x00000042CE5F4000-0x00000042CE600000
2026-05-28 21:12:21,284 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,287 [root] DEBUG: 8060: Commandline: C:\Windows\system32\svchost.exe -k netsvcs -p
2026-05-28 21:12:21,289 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,290 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,290 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,291 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,297 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,298 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,303 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,304 [root] DEBUG: 8060: Hooked 69 out of 69 functions
2026-05-28 21:12:21,304 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,305 [root] INFO: Loaded monitor into process with pid 8060
2026-05-28 21:12:21,307 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 21:12:21,308 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:21,312 [lib.api.process] INFO: Injected into 64-bit <Process 8060 svchost.exe>
2026-05-28 21:12:21,315 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,316 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,322 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,322 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,327 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,327 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,330 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,331 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,335 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,336 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,336 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,338 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,340 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,341 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,349 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,351 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,353 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,354 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,356 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,357 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,359 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,361 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,361 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,363 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,366 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,367 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,368 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,369 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,372 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,372 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,373 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,377 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,377 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,378 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,382 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,382 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,383 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,383 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,389 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,389 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,390 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,390 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,396 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,396 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,401 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,401 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,405 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,406 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,410 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,412 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,417 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,417 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,418 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,418 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,422 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,423 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,428 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,428 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,433 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,433 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,436 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,436 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,438 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,438 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,442 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,444 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,448 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,448 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,449 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,449 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,452 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,453 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,456 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,456 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,457 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,457 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,462 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,463 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,464 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,464 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,469 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,469 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,473 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,475 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,479 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,479 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,484 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,485 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,489 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,490 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,494 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,495 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,497 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,498 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,499 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,500 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,502 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,503 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,506 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,507 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,510 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,511 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,512 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,512 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,515 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,516 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,518 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,518 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,525 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,526 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,530 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,531 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,533 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,535 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,536 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,537 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,542 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,542 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,546 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,547 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,551 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,552 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,557 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,558 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,563 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,564 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,567 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,568 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,568 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,569 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,573 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,574 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,574 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,575 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,580 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,581 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,585 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,586 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,592 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,593 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,594 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,595 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,600 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,601 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,602 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,603 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,608 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,609 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,612 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,613 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,614 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,615 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,620 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,621 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,626 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,627 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,633 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,633 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,636 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,637 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,638 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,639 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,643 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,644 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,645 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,646 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,649 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,650 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,652 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,652 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,658 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,659 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,661 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,662 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,664 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,665 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,670 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,672 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,677 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,677 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,678 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,679 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,682 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,683 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,685 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,686 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,688 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,689 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,691 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,693 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,694 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,695 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,699 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,699 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,700 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,702 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,708 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,709 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,715 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,716 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,721 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,721 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,727 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,727 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,730 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,731 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,733 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,733 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,735 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,736 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,738 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,739 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,744 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,744 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,749 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,750 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,755 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,756 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,762 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,762 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,768 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,768 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,774 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,776 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,784 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,787 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,793 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,795 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,800 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,801 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,806 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,806 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,811 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,811 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,811 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,812 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,816 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,817 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,821 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,822 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,827 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,827 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,832 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,833 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,838 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,839 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,843 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,843 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,848 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,849 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,853 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,854 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,858 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,859 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,864 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,865 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,870 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,870 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,874 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,875 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,880 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,881 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,885 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,886 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,890 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,890 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,894 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,896 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,900 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,900 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,905 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,905 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,909 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,910 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,914 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,915 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,919 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,921 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,925 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,926 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,928 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,928 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,930 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,931 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,933 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,934 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,935 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,936 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,940 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,942 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,947 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,947 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,952 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,953 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,959 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,960 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,966 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,966 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,970 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,971 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,975 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,976 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,980 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,981 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,985 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,986 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,990 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,990 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:21,995 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:21,996 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,002 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,003 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,019 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,020 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,025 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,025 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,030 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,030 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,034 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,035 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,039 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,039 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,043 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,044 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,049 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,049 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,054 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,054 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,055 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,056 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,061 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,062 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,068 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,069 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,075 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,076 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,080 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,081 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,082 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,082 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,085 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,086 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,091 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,092 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,093 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,093 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,096 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,097 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,097 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,098 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,100 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 24460: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:22,103 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 24460
2026-05-28 21:12:22,103 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,104 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,108 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,108 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,109 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,109 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,110 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,111 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,112 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 24460
2026-05-28 21:12:22,116 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,116 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,117 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,118 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,118 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,119 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,124 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,124 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,125 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,126 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,129 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,130 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,130 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,131 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,137 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,137 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,142 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,143 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,149 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,149 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,155 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,156 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,161 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,163 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,167 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,168 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,170 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,171 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,174 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,175 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,176 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,177 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,180 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,180 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,185 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,186 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,190 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,191 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,195 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,196 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,201 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,201 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,205 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,206 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,210 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,211 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,216 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,216 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,220 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,221 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,225 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,226 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,231 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,231 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,235 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,236 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,240 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,241 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,245 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,245 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,248 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,249 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,251 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,252 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,253 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,253 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,257 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,258 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,263 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,264 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,274 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,276 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,277 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,277 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,280 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,281 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,282 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,283 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,285 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,285 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,288 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,288 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,290 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,292 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,297 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,298 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,303 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,304 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,311 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,313 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,318 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,318 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,324 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,324 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,329 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,329 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,334 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,335 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,339 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,340 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,344 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,345 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,349 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,350 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,354 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,355 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,360 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,360 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,364 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,365 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,370 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,371 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,375 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,376 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,380 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,381 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,385 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,386 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,391 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,391 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,395 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,396 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,400 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,401 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,405 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,406 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,410 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,411 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,415 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,416 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,420 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,421 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,426 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,426 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,431 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,431 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,436 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,436 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,441 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,442 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,447 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,447 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,448 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,448 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,452 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,453 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,453 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,454 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,457 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,458 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,458 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,459 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,463 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,464 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,469 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,470 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,474 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,475 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,476 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,477 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,480 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,481 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,482 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,482 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,485 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,486 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,488 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,489 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,490 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,491 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,495 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,496 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,500 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,501 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,502 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,503 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,505 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,506 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,511 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,511 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,516 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,517 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,517 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,518 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,521 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,521 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,523 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,523 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,526 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,527 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,531 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,532 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,536 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,536 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,540 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,541 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,546 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,547 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,551 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,552 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,557 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,558 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,562 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,563 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,567 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,568 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,572 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,573 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,577 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,577 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,582 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,582 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,586 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,587 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,591 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,591 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,596 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,596 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,600 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,600 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,601 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,601 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,605 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,606 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,610 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,610 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,615 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,615 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,620 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,620 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,624 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,625 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,630 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,631 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,635 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,636 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,638 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,638 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,640 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,641 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,646 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,647 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,649 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,650 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,652 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,652 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,657 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,658 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,662 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,663 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,667 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,668 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,670 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,671 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,673 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,674 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,678 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,679 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,683 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,684 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,689 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,689 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,694 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,694 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,696 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,696 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,701 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,702 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,706 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,707 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,712 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,712 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,717 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,717 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,722 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,722 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,728 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,728 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,733 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,733 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,737 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,738 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,743 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,744 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,749 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,750 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,754 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,756 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,760 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,762 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,766 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,767 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,772 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,773 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,777 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,778 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,782 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,783 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,787 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,788 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,792 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,793 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,795 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,796 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,797 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,798 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,802 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,803 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,807 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,808 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,812 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,813 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,817 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,818 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,822 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,822 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,827 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,827 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,831 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,832 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,836 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,837 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,841 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,842 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,846 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,847 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,851 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,851 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,855 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,856 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,860 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,860 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,864 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,866 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,870 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,870 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,871 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,871 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,875 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,875 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,880 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,880 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,884 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,885 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,889 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,890 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,894 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,895 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,899 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,900 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,904 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,904 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,908 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,908 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,913 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,913 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,917 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,918 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,922 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,923 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,928 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,929 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,934 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,934 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,938 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,939 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,943 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,944 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,948 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,948 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,952 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,952 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,956 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,957 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,961 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,961 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,966 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,966 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,971 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,972 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,976 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,977 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,981 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,982 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,986 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,986 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,990 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,991 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:22,995 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:22,996 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,001 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,002 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,007 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,008 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,012 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,012 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,017 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,017 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,021 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,022 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,026 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,027 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,030 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,031 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,035 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,036 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,041 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,041 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,045 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,046 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,050 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,051 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,055 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,056 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,060 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,061 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,065 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,066 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,071 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,072 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,076 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,077 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,084 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,085 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,089 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,090 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,095 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,096 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,101 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,101 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,106 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,106 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,111 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,112 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,116 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,116 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,122 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,122 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,128 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,128 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,132 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,133 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,141 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,142 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,146 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,147 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,151 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,152 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,156 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,156 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,161 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,162 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,166 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,167 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,171 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,171 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,175 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,176 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,180 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,181 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,185 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,186 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,190 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,190 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,195 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,196 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,200 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,200 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,204 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,205 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,210 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,210 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,215 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,215 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,219 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,219 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,220 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,220 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,224 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,225 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,226 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,227 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,229 [root] DEBUG: 12636: CreateProcessHandler: Injection info set for new process 26524: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:12:23,230 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 26524
2026-05-28 21:12:23,231 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,235 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,236 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,236 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,238 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,238 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,239 [root] DEBUG: 12636: ProcessMessage: Skipping monitoring process 26524
2026-05-28 21:12:23,243 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,243 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,244 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,244 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,246 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,247 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,252 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,253 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,253 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,254 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,254 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,255 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,258 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,258 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,259 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,260 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,263 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,263 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,269 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,270 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,270 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,271 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,275 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,277 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,281 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,284 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,287 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,288 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,293 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,294 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,301 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,302 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,303 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,304 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,307 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,309 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,315 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,316 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,316 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,317 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,320 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,320 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,325 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,326 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,329 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,331 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,332 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,333 [root] DEBUG: 18964: DLL loaded at 0x00007FFF3FD20000: C:\Windows\system32\wbem\wbemprox (0x11000 bytes).
2026-05-28 21:12:23,334 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,338 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,339 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,343 [root] DEBUG: 18964: DLL loaded at 0x00007FFF3F950000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2026-05-28 21:12:23,344 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,345 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,353 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,354 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,356 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,357 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,359 [root] DEBUG: 18964: DLL loaded at 0x00007FFF4D000000: C:\Windows\system32\wbem\wmiutils (0x28000 bytes).
2026-05-28 21:12:23,360 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,361 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,362 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,362 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,367 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,368 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,368 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,368 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,374 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,375 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,376 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,377 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,378 [root] DEBUG: 18964: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:12:23,379 [root] DEBUG: 18964: DLL loaded at 0x00007FFF13200000: C:\Windows\SYSTEM32\framedynos (0x52000 bytes).
2026-05-28 21:12:23,379 [root] DEBUG: 18964: DLL loaded at 0x00007FFF123E0000: C:\Windows\system32\wbem\cimwin32 (0x20c000 bytes).
2026-05-28 21:12:23,381 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,382 [root] DEBUG: 18964: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:12:23,382 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,383 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,384 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,388 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,390 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,391 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,392 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,397 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,397 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,398 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,399 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,403 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,403 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,405 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,406 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,406 [root] DEBUG: 18964: DLL loaded at 0x0000017AC8F50000: C:\Windows\SYSTEM32\WMI (0x3000 bytes).
2026-05-28 21:12:23,408 [root] DEBUG: 18964: DLL loaded at 0x00007FFF520C0000: C:\Windows\SYSTEM32\wmiclnt (0x11000 bytes).
2026-05-28 21:12:23,408 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,409 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,410 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,410 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,413 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,415 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,415 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,416 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,419 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,421 [root] DEBUG: 18964: CreateThreadBreakpoints: Failed to open thread and get a handle.
2026-05-28 21:12:23,421 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,422 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,424 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,426 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,427 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,428 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,429 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,430 [root] DEBUG: 18964: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\wtsapi32 (0x14000 bytes).
2026-05-28 21:12:23,432 [root] DEBUG: 18964: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 21:12:23,433 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,434 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,434 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,435 [root] DEBUG: 18964: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 21:12:23,435 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,436 [root] DEBUG: 18964: DLL loaded at 0x00007FFF572F0000: C:\Windows\SYSTEM32\DEVOBJ (0x33000 bytes).
2026-05-28 21:12:23,441 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,441 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,442 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,442 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,446 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,447 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,448 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,448 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,453 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,454 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,454 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,455 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,457 [root] DEBUG: 18964: DLL loaded at 0x00007FFF43550000: C:\Windows\SYSTEM32\NETAPI32 (0x19000 bytes).
2026-05-28 21:12:23,462 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,463 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,463 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,464 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,465 [root] DEBUG: 18964: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\SYSTEM32\SAMCLI (0x19000 bytes).
2026-05-28 21:12:23,466 [root] DEBUG: 18964: DLL loaded at 0x00007FFF4D670000: C:\Windows\SYSTEM32\SRVCLI (0x28000 bytes).
2026-05-28 21:12:23,466 [root] DEBUG: 18964: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\NETUTILS (0xc000 bytes).
2026-05-28 21:12:23,467 [root] DEBUG: 18964: DLL loaded at 0x00007FFF56B10000: C:\Windows\SYSTEM32\LOGONCLI (0x43000 bytes).
2026-05-28 21:12:23,468 [root] DEBUG: 18964: DLL loaded at 0x00007FFF4F530000: C:\Windows\SYSTEM32\SCHEDCLI (0xc000 bytes).
2026-05-28 21:12:23,469 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,470 [root] DEBUG: 18964: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\WKSCLI (0x19000 bytes).
2026-05-28 21:12:23,470 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,471 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,472 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,475 [root] DEBUG: 18964: DLL loaded at 0x00007FFF52850000: C:\Windows\SYSTEM32\DSROLE (0xa000 bytes).
2026-05-28 21:12:23,476 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,476 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,477 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,478 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,482 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,483 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,484 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,485 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,487 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,487 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,489 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,489 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,492 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,492 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,494 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,496 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,497 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,498 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,501 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,501 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,502 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,503 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,507 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,508 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,512 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,528 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,535 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,537 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,538 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,540 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,542 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,542 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,547 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,549 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,549 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,550 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,553 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,553 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,555 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,558 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,564 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,564 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,565 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,565 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,569 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,569 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,570 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,570 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,574 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,576 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,577 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,579 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,583 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,583 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,584 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,585 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,589 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,589 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,590 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,590 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,591 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,591 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,597 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,597 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,598 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,598 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,602 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,603 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,603 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,604 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,604 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,605 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,608 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,609 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,610 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,611 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,614 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,615 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,616 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,616 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,619 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,620 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,621 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,621 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,626 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,626 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,627 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,628 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,631 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,631 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,632 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,633 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,638 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,639 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,639 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,640 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,645 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,645 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,646 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,647 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,650 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,651 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,651 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,652 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,655 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,658 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,658 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,659 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,662 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,662 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,665 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,665 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,666 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,668 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,669 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,670 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,673 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,673 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,674 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,675 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,678 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,679 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,681 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,681 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,683 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,683 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,686 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,687 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,688 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,689 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,690 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,692 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,693 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,693 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,697 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,700 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,700 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,700 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,704 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,705 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,706 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,707 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,709 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,710 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,712 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,713 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,713 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,714 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,718 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,719 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,720 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,721 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,725 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,725 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,726 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,726 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,731 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,731 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,732 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,732 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,736 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,736 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,737 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,737 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,740 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,741 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,741 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,742 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,745 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,745 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,747 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,748 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,750 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,750 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,752 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,753 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,755 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,755 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,757 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,758 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,760 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,761 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,764 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,764 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,765 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,765 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,768 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,769 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,769 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,770 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,773 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,774 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,774 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,775 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,778 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,779 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,780 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,781 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,784 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,785 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,785 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,786 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,791 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,792 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,792 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,793 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,796 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,797 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,798 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,798 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,802 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,803 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,803 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,804 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,808 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,808 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,809 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,810 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,813 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,813 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,818 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,819 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,819 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,820 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,823 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,824 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,825 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,826 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,829 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,829 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,831 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,831 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,833 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,834 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,836 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,836 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,838 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,839 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,842 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,842 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,843 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,843 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,846 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,847 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,848 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,849 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,851 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,852 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,854 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,854 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,856 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,857 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,858 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,859 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,861 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,861 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,863 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,865 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,866 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,867 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,869 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,869 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,871 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,872 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,873 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,874 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,876 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,877 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,878 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,878 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,882 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,883 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,884 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,884 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,888 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,888 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,889 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,890 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,897 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,898 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,898 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,899 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,902 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,903 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,903 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,904 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,908 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,908 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,908 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,909 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,912 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,914 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,914 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,915 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,925 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,926 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,928 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,929 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,932 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,932 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,934 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,934 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,937 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,938 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,938 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,939 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,942 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,945 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,945 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,946 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,950 [root] DEBUG: 
2026-05-28 21:12:23,951 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,951 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,953 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,955 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,958 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,958 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,959 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,962 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,963 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,963 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,964 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,967 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,967 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,968 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,968 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,972 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,973 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,973 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,974 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,976 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,977 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,978 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,979 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,981 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,982 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,983 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,983 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,985 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,986 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,988 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,989 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,991 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,992 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,995 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,995 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,996 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:23,996 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:23,999 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,000 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,000 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,001 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,004 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,005 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,006 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,006 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,010 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,011 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,011 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,012 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,015 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,015 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,016 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,018 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,021 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,021 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,024 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,024 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,025 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,026 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,028 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,029 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,030 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,030 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,032 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,033 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,035 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,035 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,038 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,039 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,041 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,041 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,043 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,044 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,045 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,046 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,048 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,048 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,050 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,050 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,053 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,054 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,055 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,055 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,058 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,058 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,062 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,062 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,063 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,063 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,066 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,067 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,068 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,068 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,071 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,072 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,073 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,073 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,076 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,077 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,077 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,078 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,082 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,082 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,083 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,083 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,087 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,087 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,088 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,088 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,098 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,099 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,099 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,100 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,100 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,101 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,105 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,106 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,109 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,110 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,114 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,114 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,119 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,119 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,124 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,125 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,129 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,132 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,136 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,137 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,142 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,142 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,147 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,147 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,151 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,152 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,153 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,154 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,156 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,157 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,161 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,161 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,173 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,174 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,178 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,179 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,183 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,185 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,190 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,191 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,198 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,198 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,199 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,200 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,205 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,205 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,210 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,211 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,215 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,216 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,220 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,220 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,227 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,228 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,233 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,234 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,239 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,239 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,246 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,247 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,252 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,256 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,262 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,263 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,264 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,265 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,269 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,270 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,275 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,277 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,281 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,282 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,289 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,289 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,290 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,295 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,297 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,298 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,304 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,304 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,305 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,306 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,310 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,311 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,311 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,312 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,321 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,322 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,322 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,330 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,330 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,331 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,335 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,336 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,336 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,337 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,341 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,341 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,343 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,345 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,353 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,354 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,354 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,359 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,360 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,361 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,365 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,366 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,366 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,366 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,371 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,373 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,373 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,374 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,378 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,379 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,382 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,383 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,387 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,388 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,389 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,392 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,394 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,394 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,397 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,398 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,398 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,399 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,402 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,404 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,406 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,408 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,415 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,416 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,416 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,417 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,421 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,423 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,424 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,432 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,438 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,438 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,443 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,445 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,449 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,449 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,454 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,454 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,462 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,463 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,468 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,469 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,473 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,475 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,482 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,482 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,487 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,488 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,495 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,497 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,502 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,502 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,508 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,508 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,513 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,514 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,518 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,519 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,524 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,525 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,527 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,528 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,530 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,531 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,540 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,540 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,542 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,543 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,548 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,549 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,550 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,550 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,555 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,556 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,561 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,562 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,567 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,568 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,573 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,574 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,578 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,578 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,583 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,585 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,590 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,591 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,595 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,596 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,599 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,604 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,605 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,606 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,612 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,613 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,613 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,618 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,623 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,623 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,627 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,628 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,634 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,635 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,640 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,640 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,645 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,646 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,652 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,653 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,657 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,658 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,662 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,663 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,666 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,667 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,672 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,673 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,677 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,678 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,686 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,688 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,688 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,689 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,693 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,694 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,698 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,700 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,706 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,706 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,712 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,713 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,713 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,713 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,721 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,722 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,724 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,725 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,730 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,732 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,734 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,735 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,737 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,740 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,744 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,748 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,752 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,752 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,753 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,754 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,757 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,759 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,760 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,761 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,767 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,767 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,768 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,770 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,772 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,775 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,776 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,777 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,780 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,781 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,781 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,783 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,788 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,789 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,789 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,790 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,795 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,795 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,795 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,796 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,803 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,804 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,805 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,808 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,811 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,811 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,815 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,817 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,821 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,821 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,826 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,827 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,828 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,832 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,832 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,833 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,841 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,842 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,849 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,850 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,856 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,856 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,870 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,871 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,876 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,880 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,881 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,882 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,885 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,885 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,886 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,886 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,890 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,891 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,892 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,892 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,897 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,898 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,903 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,903 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,908 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,909 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,916 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,916 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,917 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,918 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,921 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,922 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,926 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,927 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,928 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,928 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,930 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,930 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,935 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,936 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,942 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,944 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,948 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,948 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,950 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,953 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,953 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,954 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,957 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,958 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,962 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,963 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,964 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,964 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,971 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,971 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,974 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,975 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,979 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,980 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,987 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,988 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,992 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,993 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:24,997 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:24,998 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,002 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,002 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,007 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,008 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,012 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,013 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,017 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,018 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,023 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,023 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,028 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,028 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,033 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,034 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,038 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,038 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,042 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,043 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,050 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,050 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,056 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,056 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,058 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,058 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,061 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,063 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,068 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,069 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,074 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,074 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,078 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,079 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,083 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,084 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,088 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,089 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,093 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,094 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,099 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,100 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,104 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,105 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,111 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,112 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,117 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,118 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,122 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,122 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,129 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,131 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,135 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,136 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,142 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,142 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,149 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,149 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,154 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,155 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,160 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,161 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,166 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,167 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,171 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,172 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,177 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,178 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,182 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,182 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,184 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,185 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,189 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,189 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,196 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,197 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,201 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,202 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,206 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,207 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,211 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,212 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,216 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,217 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,221 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,223 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,228 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,228 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,234 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,234 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,239 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,240 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,245 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,245 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,249 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,250 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,255 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,255 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,260 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,260 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,265 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,265 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,270 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,270 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,275 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,275 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,280 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,280 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,284 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,285 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,290 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,290 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,295 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,295 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,299 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,300 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,306 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,308 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,312 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,313 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,317 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,318 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,322 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,323 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,327 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,327 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,331 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,332 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,337 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,339 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,345 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,347 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,351 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,353 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,357 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,357 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,362 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,362 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,367 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,368 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,372 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,373 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,377 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,378 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,382 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,383 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,387 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,388 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,392 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,392 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,396 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,397 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,399 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,399 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,402 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,402 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,406 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,409 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,413 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,414 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,418 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,418 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,422 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,423 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,427 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,427 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,431 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,432 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,436 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,436 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,440 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,441 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,445 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,445 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,450 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,450 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,454 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,455 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,459 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,460 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,464 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,465 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,469 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,469 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,473 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,473 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,478 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,478 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,482 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,482 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,486 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,487 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,491 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,492 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,496 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,496 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,500 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,501 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,505 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,506 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,510 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,510 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,515 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,515 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,519 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,520 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,524 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,525 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,525 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,526 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,530 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,530 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,536 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,536 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,540 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,541 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,545 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,545 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,551 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,551 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,556 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,556 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,560 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,561 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,565 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,565 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,569 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,569 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,574 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,574 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,578 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,579 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,583 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,583 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,589 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,590 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,593 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,594 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,598 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,600 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,604 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,605 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,609 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,610 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,614 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,615 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,619 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,620 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,624 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,624 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,629 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,630 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,635 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,635 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,641 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,642 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,646 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,647 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,651 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,651 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,655 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,656 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,661 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,662 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,666 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,666 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,670 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,671 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,676 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,676 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,680 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,681 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,687 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,687 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,692 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,692 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,701 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,701 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,705 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,706 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,711 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,711 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,715 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,716 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,720 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,721 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,726 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,727 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,731 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,731 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,741 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,742 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,746 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,747 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,751 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,752 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,779 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,780 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,784 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,785 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,789 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,791 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,796 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,796 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,824 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263604e+00 (from 6.263195e+00)
2026-05-28 21:12:25,825 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,826 [root] DEBUG: 12636: DLL loaded at 0x00007FFF4F430000: C:\Windows\System32\perfos (0xf000 bytes).
2026-05-28 21:12:25,930 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:25,932 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,936 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:25,937 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,941 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:25,943 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:25,993 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:25,993 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:26,646 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:26,647 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:26,971 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:26,972 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,008 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,009 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,013 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,014 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,023 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,023 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,028 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,028 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,035 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,036 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,041 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,041 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,048 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,049 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,054 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,057 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,060 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,061 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,061 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,061 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,062 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,065 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,066 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,067 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,070 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,072 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,076 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,077 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,082 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,082 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,088 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,088 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,093 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,094 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,098 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,100 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,105 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,105 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,111 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,111 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,116 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,117 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,124 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,125 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,130 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,131 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,135 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,136 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,140 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,141 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,149 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,152 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,158 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,158 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,158 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,159 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,169 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,170 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,174 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,175 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,180 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,180 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,185 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,186 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,237 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,238 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,246 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,247 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,252 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,252 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,259 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,260 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,319 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,320 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,364 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,365 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,371 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,374 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,381 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,383 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,403 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,405 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,447 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,448 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,591 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,592 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,600 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,601 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,623 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,624 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:27,645 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:27,645 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:28,008 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:28,009 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:29,009 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:29,010 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:29,576 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:29,577 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:29,606 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:29,606 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:29,641 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:29,642 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:29,738 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:29,738 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:29,768 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:29,769 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:29,790 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:29,792 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:29,980 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:29,981 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:30,005 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:30,005 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:30,333 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:30,334 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:30,438 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:30,438 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:30,711 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:30,712 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:31,068 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:31,069 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:31,205 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:31,206 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:32,802 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:32,803 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:33,574 [root] INFO: Announced starting service "b'GoogleUpdaterService149.0.7814.0'"
2026-05-28 21:12:33,575 [lib.api.process] INFO: Monitor config for process 676: C:\lpw_albt\dll\676.ini
2026-05-28 21:12:33,577 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:33,579 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:33,583 [root] DEBUG: Loader: Injecting process 676 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:33,584 [root] DEBUG: Loader: Copied config file C:\lpw_albt\dll\676.ini to system path C:\676.ini
2026-05-28 21:12:33,586 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 676 C:\lpw_albt\dll\TQDMPSoj.dll
2026-05-28 21:12:33,586 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:33,588 [lib.api.process] INFO: Injected into 64-bit <Process 676 services.exe>
2026-05-28 21:12:34,955 [root] DEBUG: 676: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:34,963 [root] DEBUG: 676: Disabling sleep skipping.
2026-05-28 21:12:34,964 [root] DEBUG: 676: Interactive desktop enabled.
2026-05-28 21:12:34,966 [root] DEBUG: 676: Dropped file limit defaulting to 100.
2026-05-28 21:12:34,968 [root] DEBUG: 676: Services hook set enabled
2026-05-28 21:12:34,989 [root] DEBUG: 676: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:34,991 [root] DEBUG: 676: Monitor initialised: 64-bit capemon loaded in process 676 at 0x00007FFEE7960000, thread 32148, image base 0x00007FF7839A0000, stack from 0x000000F2F0072000-0x000000F2F0080000
2026-05-28 21:12:34,992 [root] DEBUG: 676: Commandline: C:\Windows\system32\services.exe
2026-05-28 21:12:35,008 [root] DEBUG: 676: Hooked 69 out of 69 functions
2026-05-28 21:12:35,011 [root] INFO: Loaded monitor into process with pid 676
2026-05-28 21:12:35,283 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:35,283 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,074 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:36,075 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,477 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:36,478 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,482 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:36,482 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,487 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:36,487 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,513 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:36,513 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,653 [root] DEBUG: 676: DLL loaded at 0x00007FFF56FA0000: C:\Windows\system32\Wldp (0x2d000 bytes).
2026-05-28 21:12:36,654 [root] DEBUG: 676: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 21:12:36,658 [root] DEBUG: 676: DLL loaded at 0x00007FFF58070000: C:\Windows\system32\SHCORE (0xad000 bytes).
2026-05-28 21:12:36,659 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 32300: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x0000000000850000
2026-05-28 21:12:36,661 [root] INFO: Announced 32-bit process name: updater.exe pid: 32300
2026-05-28 21:12:36,662 [lib.api.process] INFO: Monitor config for process 32300: C:\lpw_albt\dll\32300.ini
2026-05-28 21:12:36,663 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:36,667 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:12:36,725 [root] DEBUG: Loader: Injecting process 32300 (thread 32304) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:12:36,727 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:36,728 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:12:36,730 [lib.api.process] INFO: Injected into 32-bit <Process 32300 updater.exe>
2026-05-28 21:12:36,732 [root] INFO: Announced 32-bit process name: updater.exe pid: 32300
2026-05-28 21:12:36,733 [lib.api.process] INFO: Monitor config for process 32300: C:\lpw_albt\dll\32300.ini
2026-05-28 21:12:36,733 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:36,736 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:12:36,742 [root] DEBUG: Loader: Injecting process 32300 (thread 32304) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:12:36,743 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:12:36,743 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:12:36,745 [lib.api.process] INFO: Injected into 32-bit <Process 32300 updater.exe>
2026-05-28 21:12:36,746 [root] INFO: Announced 32-bit process name: updater.exe pid: 32300
2026-05-28 21:12:36,747 [lib.api.process] INFO: Monitor config for process 32300: C:\lpw_albt\dll\32300.ini
2026-05-28 21:12:36,747 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:36,750 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:12:36,756 [root] DEBUG: Loader: Injecting process 32300 with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:12:36,756 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2026-05-28 21:12:36,804 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:36,804 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,809 [root] DEBUG: 32300: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:36,809 [root] DEBUG: 32300: Interactive desktop enabled.
2026-05-28 21:12:36,809 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:36,810 [root] DEBUG: 32300: Dropped file limit defaulting to 100.
2026-05-28 21:12:36,811 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,815 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:36,815 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:36,824 [root] DEBUG: 32300: Disabling sleep skipping.
2026-05-28 21:12:36,827 [root] DEBUG: 32300: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:36,828 [root] DEBUG: 32300: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:36,877 [root] DEBUG: 32300: Monitor initialised: 32-bit capemon loaded in process 32300 at 0x6ae20000, thread 32432, image base 0x850000, stack from 0x53f5000-0x5400000
2026-05-28 21:12:36,878 [root] DEBUG: 32300: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update
2026-05-28 21:12:36,911 [root] DEBUG: 32300: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:12:36,934 [root] DEBUG: 32300: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:12:36,937 [root] DEBUG: 32300: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:12:36,953 [root] DEBUG: 32300: Hooked 632 out of 632 functions
2026-05-28 21:12:37,006 [root] DEBUG: 32300: Syscall hook installed, syscall logging level 1
2026-05-28 21:12:37,021 [root] DEBUG: 32300: RestoreHeaders: Restored original import table.
2026-05-28 21:12:37,026 [root] INFO: Loaded monitor into process with pid 32300
2026-05-28 21:12:37,043 [root] DEBUG: 32300: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 32432).
2026-05-28 21:12:37,045 [root] DEBUG: 32300: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:12:37,051 [root] DEBUG: 32300: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,089 [root] DEBUG: 32300: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,126 [root] DEBUG: 32300: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,163 [root] DEBUG: 32300: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,199 [root] DEBUG: 32300: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,236 [root] DEBUG: 32300: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,271 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,272 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,274 [root] DEBUG: 32300: caller_dispatch: Added region at 0x04FA0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x04FA0037, thread 32432).
2026-05-28 21:12:37,274 [root] DEBUG: 32300: DumpPEsInRange: Scanning range 0x04FA0000 - 0x04FA0129.
2026-05-28 21:12:37,275 [root] DEBUG: 32300: ScanForDisguisedPE: Size too small: 0x129 bytes
2026-05-28 21:12:37,278 [root] DEBUG: 32300: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::LdrLoadDll returns to 0x00A551D4, thread 32496).
2026-05-28 21:12:37,278 [root] DEBUG: 32300: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:12:37,279 [root] DEBUG: 32300: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,284 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,285 [lib.common.results] INFO: Uploading file C:\EsskdWmsyS\CAPE\32300_64373343712129552026 to CAPE\9bad90015d04e513c0f6dd91a66ef7fa1949ec89d314e7252d3d267f6ec0be43; Size is 297; Max size: 100000000
2026-05-28 21:12:37,286 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,295 [root] DEBUG: 32300: DumpMemory: Payload successfully created: C:\EsskdWmsyS\CAPE\32300_64373343712129552026 (size 297 bytes)
2026-05-28 21:12:37,296 [root] DEBUG: 32300: DumpRegion: Dumped entire allocation from 0x04FA0000, size 4096 bytes.
2026-05-28 21:12:37,296 [root] DEBUG: 32300: ProcessTrackedRegion: Dumped region at 0x04FA0000.
2026-05-28 21:12:37,296 [root] DEBUG: 32300: YaraScan: Scanning 0x04FA0000, size 0x129
2026-05-28 21:12:37,319 [root] DEBUG: 32300: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:12:37,326 [root] DEBUG: 32300: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:12:37,329 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 21:12:37,329 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:12:37,331 [lib.api.process] INFO: Injected into 32-bit <Process 32300 updater.exe>
2026-05-28 21:12:37,342 [root] DEBUG: 32300: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:12:37,345 [root] DEBUG: 32300: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:12:37,346 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,346 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,367 [root] DEBUG: 32300: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:12:37,368 [root] DEBUG: 32300: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:12:37,381 [root] DEBUG: 32300: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:12:37,416 [root] DEBUG: 32300: CreateProcessHandler: Injection info set for new process 32696: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x00850000
2026-05-28 21:12:37,417 [root] INFO: Announced 32-bit process name: updater.exe pid: 32696
2026-05-28 21:12:37,417 [lib.api.process] INFO: Monitor config for process 32696: C:\lpw_albt\dll\32696.ini
2026-05-28 21:12:37,418 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:37,420 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:12:37,426 [root] DEBUG: Loader: Injecting process 32696 (thread 32700) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:12:37,426 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,427 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,428 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:37,428 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:12:37,431 [lib.api.process] INFO: Injected into 32-bit <Process 32696 updater.exe>
2026-05-28 21:12:37,439 [root] DEBUG: 32300: DLL loaded at 0x74960000: C:\Windows\system32\apphelp (0x9f000 bytes).
2026-05-28 21:12:37,452 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,453 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,455 [root] DEBUG: 32696: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:37,456 [root] DEBUG: 32696: Interactive desktop enabled.
2026-05-28 21:12:37,456 [root] DEBUG: 32696: Dropped file limit defaulting to 100.
2026-05-28 21:12:37,463 [root] DEBUG: 32696: Disabling sleep skipping.
2026-05-28 21:12:37,465 [root] DEBUG: 32696: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:37,466 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,504 [root] DEBUG: 32696: Monitor initialised: 32-bit capemon loaded in process 32696 at 0x6ae20000, thread 32700, image base 0x850000, stack from 0x4fd4000-0x4fe0000
2026-05-28 21:12:37,505 [root] DEBUG: 32696: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2f8,0xe08584,0xe08
2026-05-28 21:12:37,528 [root] DEBUG: 32696: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:12:37,543 [root] DEBUG: 32696: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:12:37,544 [root] DEBUG: 32696: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:12:37,548 [root] DEBUG: 32696: Hooked 632 out of 632 functions
2026-05-28 21:12:37,580 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,581 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,585 [root] DEBUG: 32696: Syscall hook installed, syscall logging level 1
2026-05-28 21:12:37,587 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,588 [root] DEBUG: 32696: RestoreHeaders: Restored original import table.
2026-05-28 21:12:37,588 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,589 [root] INFO: Loaded monitor into process with pid 32696
2026-05-28 21:12:37,593 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,594 [root] DEBUG: 32696: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 32700).
2026-05-28 21:12:37,595 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,596 [root] DEBUG: 32696: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:12:37,600 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,603 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,604 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,619 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,620 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,626 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,627 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,631 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,632 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,640 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,651 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,652 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,659 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,669 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,678 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,719 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,761 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,800 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,840 [root] DEBUG: 32696: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:12:37,841 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,847 [root] DEBUG: 32696: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00B218AC, thread 32700).
2026-05-28 21:12:37,848 [root] DEBUG: 32696: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:12:37,882 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:37,884 [root] DEBUG: 32696: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:12:37,884 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:37,885 [root] DEBUG: 32696: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:12:37,896 [root] DEBUG: 32696: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 3.815347e-06)
2026-05-28 21:12:37,900 [root] DEBUG: 32696: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:12:37,901 [root] DEBUG: 32696: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:12:37,905 [root] DEBUG: 32696: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:12:37,905 [root] DEBUG: 32696: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:12:37,909 [root] DEBUG: 32696: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:12:37,914 [root] DEBUG: 32696: OpenProcessHandler: Image base for process 32300 (handle 0x2d4): 0x00850000.
2026-05-28 21:12:37,915 [root] DEBUG: 32696: OpenProcessHandler: Injection info created for process 32300, handle 0x2d4: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
2026-05-28 21:12:37,920 [root] INFO: Added new file to list with pid 32696 and path C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\metadata
2026-05-28 21:12:37,930 [root] INFO: Added new file to list with pid 32300 and path C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\settings.dat
2026-05-28 21:12:37,938 [root] DEBUG: 32300: DLL loaded at 0x74950000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-28 21:12:37,942 [root] DEBUG: 32300: DLL loaded at 0x76650000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-05-28 21:12:37,953 [root] DEBUG: 32300: OpenProcessHandler: Injection info created for process 4484, handle 0x368: C:\Windows\explorer.exe
2026-05-28 21:12:38,070 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:38,071 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:38,089 [root] DEBUG: 32300: DLL loaded at 0x748A0000: C:\Windows\SYSTEM32\wkscli (0x11000 bytes).
2026-05-28 21:12:38,094 [root] DEBUG: 32300: DLL loaded at 0x74890000: C:\Windows\SYSTEM32\netutils (0xb000 bytes).
2026-05-28 21:12:38,098 [root] DEBUG: 32300: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-28 21:12:38,099 [root] DEBUG: 32300: DLL loaded at 0x6ADC0000: C:\Windows\SYSTEM32\MDMRegistration (0x53000 bytes).
2026-05-28 21:12:38,141 [root] DEBUG: 32300: DLL loaded at 0x6F2A0000: C:\Windows\SYSTEM32\powrprof (0x44000 bytes).
2026-05-28 21:12:38,142 [root] DEBUG: 32300: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2026-05-28 21:12:38,143 [root] DEBUG: 32300: DLL loaded at 0x70D00000: C:\Windows\SYSTEM32\ncrypt (0x21000 bytes).
2026-05-28 21:12:38,144 [root] DEBUG: 32300: DLL loaded at 0x76790000: C:\Windows\System32\imagehlp (0x19000 bytes).
2026-05-28 21:12:38,144 [root] DEBUG: 32300: DLL loaded at 0x6AD00000: C:\Windows\SYSTEM32\tbs (0x13000 bytes).
2026-05-28 21:12:38,145 [root] DEBUG: 32300: DLL loaded at 0x6AD20000: C:\Windows\SYSTEM32\DMCmnUtils (0x63000 bytes).
2026-05-28 21:12:38,146 [root] DEBUG: 32300: DLL loaded at 0x6AD90000: C:\Windows\SYSTEM32\omadmapi (0x2c000 bytes).
2026-05-28 21:12:38,152 [root] DEBUG: 32300: DLL loaded at 0x6F290000: C:\Windows\SYSTEM32\UMPDC (0xd000 bytes).
2026-05-28 21:12:38,154 [root] DEBUG: 32300: DLL loaded at 0x70200000: C:\Windows\SYSTEM32\NTASN1 (0x28000 bytes).
2026-05-28 21:12:38,163 [root] DEBUG: 32300: DLL loaded at 0x70670000: C:\Windows\system32\netapi32 (0x14000 bytes).
2026-05-28 21:12:38,165 [root] DEBUG: 32300: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-28 21:12:38,165 [root] DEBUG: 32300: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\cryptsp (0x13000 bytes).
2026-05-28 21:12:38,166 [root] DEBUG: 32300: DLL loaded at 0x6EC40000: C:\Windows\SYSTEM32\DSREG (0x107000 bytes).
2026-05-28 21:12:38,192 [root] DEBUG: 32300: DLL loaded at 0x74180000: C:\Windows\SYSTEM32\profapi (0x1c000 bytes).
2026-05-28 21:12:38,231 [root] DEBUG: 32300: OpenProcessHandler: Injection info created for process 948, handle 0x474: C:\Windows\System32\svchost.exe
2026-05-28 21:12:38,235 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 21:12:38,235 [root] DEBUG: 32300: OpenProcessHandler: Injection info created for process 12636, handle 0x478: Error obtaining target process name
2026-05-28 21:12:38,238 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:38,239 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:38,243 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:38,243 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:38,255 [root] DEBUG: 12636: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF13A00000: 6.263607e+00 (from 6.263195e+00)
2026-05-28 21:12:38,255 [root] DEBUG: 12636: ProcessTrackedRegion: Region at 0x00007FFF13A00000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:12:38,264 [root] DEBUG: 12636: DLL loaded at 0x00007FFF524B0000: C:\Windows\System32\taskschd (0xac000 bytes).
2026-05-28 21:12:38,973 [root] INFO: Process with pid 12636 appears to have terminated
2026-05-28 21:12:48,107 [root] INFO: Added new file to list with pid 32300 and path C:\Program Files (x86)\Google\GoogleUpdater\c58d5d25-54e2-4381-8733-333b06c231dd.tmp
2026-05-28 21:12:48,109 [root] INFO: Error dumping file from path "C:\Program Files (x86)\Google\GoogleUpdater\88ff190d-24a5-42ae-973c-2f3f32734560.tmp": [Errno 13] Permission denied: 'C:\\Program Files (x86)\\Google\\GoogleUpdater\\88ff190d-24a5-42ae-973c-2f3f32734560.tmp'
2026-05-28 21:12:48,110 [root] INFO: Error dumping file from path "C:\Program Files (x86)\Google\GoogleUpdater\88ff190d-24a5-42ae-973c-2f3f32734560.tmp": [Errno 13] Permission denied: 'C:\\Program Files (x86)\\Google\\GoogleUpdater\\88ff190d-24a5-42ae-973c-2f3f32734560.tmp'
2026-05-28 21:12:48,113 [root] INFO: Added new file to list with pid 32300 and path C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
2026-05-28 21:12:48,120 [lib.common.results] INFO: Uploading file C:\Program Files (x86)\Google\GoogleUpdater\88ff190d-24a5-42ae-973c-2f3f32734560.tmp to files\efa13cd06d7b9ec7889d7900c3cc9cce5d3cf9e1595153b9e86087ae461affa6; Size is 1347; Max size: 100000000
2026-05-28 21:12:48,270 [root] INFO: Added new file to list with pid 32300 and path C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
2026-05-28 21:12:48,271 [root] INFO: Added new file to list with pid 32300 and path C:\Program Files (x86)\Google\GoogleUpdater\updater.log
2026-05-28 21:12:48,272 [root] INFO: Process with pid 32300 has terminated
2026-05-28 21:12:48,273 [root] DEBUG: 32300: NtTerminateProcess hook: Attempting to dump process 32300
2026-05-28 21:12:48,276 [root] DEBUG: 32300: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:12:48,287 [root] INFO: Process with pid 32696 has terminated
2026-05-28 21:12:48,288 [root] DEBUG: 32696: NtTerminateProcess hook: Attempting to dump process 32696
2026-05-28 21:12:48,292 [root] DEBUG: 32696: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:12:56,044 [root] DEBUG: 4484: CreateProcessHandler: Injection info set for new process 33484: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-28 21:12:56,045 [root] INFO: Announced 64-bit process name: msedge.exe pid: 33484
2026-05-28 21:12:56,046 [lib.api.process] INFO: Monitor config for process 33484: C:\lpw_albt\dll\33484.ini
2026-05-28 21:12:56,048 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:56,062 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:56,070 [root] DEBUG: Loader: Injecting process 33484 (thread 33488) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:56,071 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:56,072 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:56,073 [lib.api.process] INFO: Injected into 64-bit <Process 33484 msedge.exe>
2026-05-28 21:12:56,075 [root] INFO: Announced 64-bit process name: msedge.exe pid: 33484
2026-05-28 21:12:56,075 [lib.api.process] INFO: Monitor config for process 33484: C:\lpw_albt\dll\33484.ini
2026-05-28 21:12:56,076 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:56,080 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:56,085 [root] DEBUG: Loader: Injecting process 33484 (thread 33488) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:56,086 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:12:56,087 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:56,088 [lib.api.process] INFO: Injected into 64-bit <Process 33484 msedge.exe>
2026-05-28 21:12:56,096 [root] INFO: Announced 64-bit process name: msedge.exe pid: 33484
2026-05-28 21:12:56,097 [lib.api.process] INFO: Monitor config for process 33484: C:\lpw_albt\dll\33484.ini
2026-05-28 21:12:56,099 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:12:56,106 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:12:56,111 [root] DEBUG: Loader: Injecting process 33484 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:56,111 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 33488, handle 0x124
2026-05-28 21:12:56,112 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:12:56,115 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:12:56,118 [lib.api.process] INFO: Injected into 64-bit <Process 33484 msedge.exe>
2026-05-28 21:12:56,127 [root] DEBUG: 33484: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:12:56,128 [root] DEBUG: 33484: Interactive desktop enabled.
2026-05-28 21:12:56,129 [root] DEBUG: 33484: Dropped file limit defaulting to 100.
2026-05-28 21:12:56,136 [root] DEBUG: 33484: Edge-specific hook-set enabled.
2026-05-28 21:12:56,139 [root] DEBUG: 33484: Disabling sleep skipping.
2026-05-28 21:12:56,142 [root] DEBUG: 33484: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:12:56,155 [root] DEBUG: 33484: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:12:56,156 [root] DEBUG: 33484: Monitor initialised: 64-bit capemon loaded in process 33484 at 0x00007FFF18240000, thread 33488, image base 0x00007FF7F5380000, stack from 0x000000BF98DF4000-0x000000BF98E00000
2026-05-28 21:12:56,157 [root] DEBUG: 33484: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
2026-05-28 21:12:56,169 [root] DEBUG: 33484: Hooked 2 out of 2 functions
2026-05-28 21:12:56,206 [root] DEBUG: 33484: Syscall hook installed, syscall logging level 1
2026-05-28 21:12:56,227 [root] DEBUG: 33484: RestoreHeaders: Restored original import table.
2026-05-28 21:12:56,228 [root] INFO: Loaded monitor into process with pid 33484
2026-05-28 21:12:56,231 [root] DEBUG: 33484: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 21:12:56,234 [root] DEBUG: 33484: DLL loaded at 0x00007FFF43500000: C:\Windows\SYSTEM32\version (0xa000 bytes).
2026-05-28 21:12:56,235 [root] DEBUG: 33484: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 21:12:56,241 [root] DEBUG: 33484: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 21:12:56,243 [root] DEBUG: 33484: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 21:12:56,245 [root] DEBUG: 33484: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-05-28 21:12:56,248 [root] DEBUG: 33484: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:12:57,223 [root] INFO: Process with pid 33484 appears to have terminated
2026-05-28 21:13:05,996 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4C1E0000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-28 21:13:06,003 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 12464: C:\Windows\System32\SecurityHealthHost.exe, ImageBase: 0x00007FF6B58F0000
2026-05-28 21:13:06,005 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 12464
2026-05-28 21:13:06,007 [lib.api.process] INFO: Monitor config for process 12464: C:\lpw_albt\dll\12464.ini
2026-05-28 21:13:06,009 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:06,014 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:06,019 [root] DEBUG: Loader: Injecting process 12464 (thread 14072) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:06,020 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:06,022 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:06,023 [lib.api.process] INFO: Injected into 64-bit <Process 12464 SecurityHealthHost.exe>
2026-05-28 21:13:06,026 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 12464
2026-05-28 21:13:06,027 [lib.api.process] INFO: Monitor config for process 12464: C:\lpw_albt\dll\12464.ini
2026-05-28 21:13:06,027 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:06,032 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:06,037 [root] DEBUG: Loader: Injecting process 12464 (thread 14072) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:06,038 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:13:06,039 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:06,040 [lib.api.process] INFO: Injected into 64-bit <Process 12464 SecurityHealthHost.exe>
2026-05-28 21:13:06,047 [root] DEBUG: 12464: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:13:06,048 [root] DEBUG: 12464: Interactive desktop enabled.
2026-05-28 21:13:06,049 [root] DEBUG: 12464: Dropped file limit defaulting to 100.
2026-05-28 21:13:06,051 [root] DEBUG: 12464: Disabling sleep skipping.
2026-05-28 21:13:06,052 [root] DEBUG: 12464: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:13:06,064 [root] DEBUG: 12464: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:13:06,064 [root] DEBUG: 12464: YaraScan: Scanning 0x00007FF6B58F0000, size 0x19174
2026-05-28 21:13:06,066 [root] DEBUG: 12464: Monitor initialised: 64-bit capemon loaded in process 12464 at 0x00007FFF18240000, thread 14072, image base 0x00007FF6B58F0000, stack from 0x0000000100074000-0x0000000100080000
2026-05-28 21:13:06,067 [root] DEBUG: 12464: Commandline: C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
2026-05-28 21:13:06,078 [root] DEBUG: 12464: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-28 21:13:06,100 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 21:13:06,101 [root] DEBUG: 12464: set_hooks: Unable to hook LockResource
2026-05-28 21:13:06,105 [root] DEBUG: 12464: Hooked 627 out of 628 functions
2026-05-28 21:13:06,107 [root] DEBUG: 12464: Syscall hook installed, syscall logging level 1
2026-05-28 21:13:06,112 [root] DEBUG: 12464: RestoreHeaders: Restored original import table.
2026-05-28 21:13:06,112 [root] INFO: Loaded monitor into process with pid 12464
2026-05-28 21:13:06,113 [root] DEBUG: 12464: caller_dispatch: Added region at 0x00007FF6B58F0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6B58FD3B2, thread 14072).
2026-05-28 21:13:06,114 [root] DEBUG: 12464: YaraScan: Scanning 0x00007FF6B58F0000, size 0x19174
2026-05-28 21:13:06,116 [root] DEBUG: 12464: ProcessImageBase: Main module image at 0x00007FF6B58F0000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:13:06,119 [root] DEBUG: 12464: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:13:06,121 [root] DEBUG: 12464: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 21:13:06,123 [root] DEBUG: 12464: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:13:06,139 [root] DEBUG: 12464: DLL loaded at 0x00007FFF56FA0000: C:\Windows\system32\Wldp (0x2d000 bytes).
2026-05-28 21:13:06,140 [root] DEBUG: 12464: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 21:13:06,142 [root] DEBUG: 12464: DLL loaded at 0x000002002B230000: C:\Windows\system32\SecurityHealthAgent (0x6d000 bytes).
2026-05-28 21:13:06,154 [root] DEBUG: 12464: DLL loaded at 0x00007FFF4C1E0000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-28 21:13:06,158 [root] DEBUG: 12464: DLL loaded at 0x00007FFF52B60000: C:\Windows\System32\msxml6 (0x25f000 bytes).
2026-05-28 21:13:06,168 [root] DEBUG: 12464: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 21:13:06,168 [root] DEBUG: 12464: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 21:13:06,169 [root] DEBUG: 12464: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 21:13:06,171 [root] DEBUG: 12464: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 21:13:06,172 [root] DEBUG: 12464: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 21:13:06,173 [root] DEBUG: 12464: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 21:13:06,179 [root] DEBUG: 12464: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 21:13:06,188 [root] DEBUG: 12464: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 21:13:06,198 [root] DEBUG: 12464: DLL loaded at 0x00007FFF3FD40000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-28 21:13:06,224 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE131000, size: 0x1000.
2026-05-28 21:13:06,230 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE121000, size: 0x1000.
2026-05-28 21:13:06,232 [root] DEBUG: 12464: NtTerminateProcess hook: Attempting to dump process 12464
2026-05-28 21:13:06,233 [root] DEBUG: 12464: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:13:06,240 [root] DEBUG: 4484: AllocationHandler: Allocation already in tracked region list: 0x00007DF4AE130000.
2026-05-28 21:13:06,243 [root] INFO: Process with pid 12464 has terminated
2026-05-28 21:13:06,283 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 22320: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, ImageBase: 0x00007FF72B200000
2026-05-28 21:13:06,284 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 22320
2026-05-28 21:13:06,285 [lib.api.process] INFO: Monitor config for process 22320: C:\lpw_albt\dll\22320.ini
2026-05-28 21:13:06,288 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:07,867 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:07,872 [root] DEBUG: Loader: Injecting process 22320 (thread 22584) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:07,873 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:07,874 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:07,875 [lib.api.process] INFO: Injected into 64-bit <Process 22320 ShellExperienceHost.exe>
2026-05-28 21:13:07,877 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 22320
2026-05-28 21:13:07,878 [lib.api.process] INFO: Monitor config for process 22320: C:\lpw_albt\dll\22320.ini
2026-05-28 21:13:07,879 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:09,412 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:09,417 [root] DEBUG: Loader: Injecting process 22320 (thread 22584) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:09,418 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:09,419 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:09,421 [lib.api.process] INFO: Injected into 64-bit <Process 22320 ShellExperienceHost.exe>
2026-05-28 21:13:09,423 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 22320
2026-05-28 21:13:09,424 [lib.api.process] INFO: Monitor config for process 22320: C:\lpw_albt\dll\22320.ini
2026-05-28 21:13:09,424 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:10,733 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:10,738 [root] DEBUG: Loader: Injecting process 22320 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:10,738 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 22584, handle 0x120
2026-05-28 21:13:10,739 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:13:10,740 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:10,741 [lib.api.process] INFO: Injected into 64-bit <Process 22320 ShellExperienceHost.exe>
2026-05-28 21:13:31,093 [root] DEBUG: 4484: DLL loaded at 0x00007FFF16070000: C:\Windows\system32\twext (0x33000 bytes).
2026-05-28 21:13:31,139 [lib.api.process] INFO: Monitor config for process 4484: C:\lpw_albt\dll\4484.ini
2026-05-28 21:13:31,140 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:31,145 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:31,149 [root] DEBUG: Loader: Injecting process 4484 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:31,150 [root] DEBUG: 4484: caller_dispatch: Added region at 0x00000000031E0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x00000000031E0044, thread 13708).
2026-05-28 21:13:31,151 [root] DEBUG: 4484: DumpPEsInRange: Scanning range 0x00000000031E0000 - 0x00000000031E0135.
2026-05-28 21:13:31,151 [root] DEBUG: 4484: ScanForDisguisedPE: Size too small: 0x135 bytes
2026-05-28 21:13:31,155 [lib.common.results] INFO: Uploading file C:\EsskdWmsyS\CAPE\4484_60273113129552026 to CAPE\238dde9d772301a309a425f89ce3bcb2090865d3a96335a2bbf68ec6edff0b4e; Size is 309; Max size: 100000000
2026-05-28 21:13:31,360 [root] DEBUG: 4484: DumpMemory: Payload successfully created: C:\EsskdWmsyS\CAPE\4484_60273113129552026 (size 309 bytes)
2026-05-28 21:13:31,361 [root] DEBUG: 4484: DumpRegion: Dumped entire allocation from 0x00000000031E0000, size 4096 bytes.
2026-05-28 21:13:31,362 [root] DEBUG: 4484: ProcessTrackedRegion: Dumped region at 0x00000000031E0000.
2026-05-28 21:13:31,363 [root] DEBUG: 4484: YaraScan: Scanning 0x00000000031E0000, size 0x135
2026-05-28 21:13:31,364 [root] DEBUG: 4484: Monitor config - unrecognised key host-ip.
2026-05-28 21:13:31,365 [root] DEBUG: 4484: Monitor config - unrecognised key host-port.
2026-05-28 21:13:31,366 [root] DEBUG: 4484: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:13:31,367 [root] DEBUG: 4484: Dropped file limit defaulting to 100.
2026-05-28 21:13:31,389 [root] DEBUG: 4484: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-28 21:13:31,431 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 21:13:31,431 [root] DEBUG: 4484: set_hooks: Unable to hook LockResource
2026-05-28 21:13:31,452 [root] DEBUG: 4484: Hooked 627 out of 628 functions
2026-05-28 21:13:31,513 [root] INFO: Loaded monitor into process with pid 4484
2026-05-28 21:13:31,518 [root] DEBUG: Error 317 (0x13d) - InjectDllViaThread: RtlCreateUserThread injection failed: The system cannot find message text for message number 0x%1 in the message file for %2.
2026-05-28 21:13:31,519 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:32,491 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 21:13:32,491 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 8044, handle 0x1f9c: Error obtaining target process name
2026-05-28 21:13:32,493 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 21:13:32,494 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 6136, handle 0x2830: Error obtaining target process name
2026-05-28 21:13:32,495 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 21:13:32,496 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 5624, handle 0x1f90: Error obtaining target process name
2026-05-28 21:13:32,497 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 21:13:32,498 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 10064, handle 0x2734: Error obtaining target process name
2026-05-28 21:13:32,498 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 21:13:32,499 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 5128, handle 0x275c: Error obtaining target process name
2026-05-28 21:13:32,500 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 21:13:32,501 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 6400, handle 0x2758: Error obtaining target process name
2026-05-28 21:13:33,602 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3BBD0000: C:\Windows\SYSTEM32\MsftEdit (0x34d000 bytes).
2026-05-28 21:13:33,604 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3BBD0000: C:\Windows\SYSTEM32\MsftEdit (0x34d000 bytes).
2026-05-28 21:13:33,624 [root] DEBUG: 4484: DLL loaded at 0x00007FFF14040000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0xa9000 bytes).
2026-05-28 21:13:33,625 [root] DEBUG: 4484: DLL loaded at 0x00007FFF14040000: C:\Program Files\Common Files\microsoft shared\ink\tiptsf (0xa9000 bytes).
2026-05-28 21:13:33,664 [root] DEBUG: 4484: DLL loaded at 0x00007FFF13C50000: C:\Windows\system32\UIRibbon (0x3ec000 bytes).
2026-05-28 21:13:33,665 [root] DEBUG: 4484: DLL loaded at 0x00007FFF13C50000: C:\Windows\system32\UIRibbon (0x3ec000 bytes).
2026-05-28 21:13:34,247 [root] INFO: Added new file to list with pid 4484 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
2026-05-28 21:13:34,259 [root] INFO: Added new file to list with pid 4484 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
2026-05-28 21:13:34,267 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 8820: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6706B0000
2026-05-28 21:13:34,269 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 8820
2026-05-28 21:13:34,269 [lib.api.process] INFO: Monitor config for process 8820: C:\lpw_albt\dll\8820.ini
2026-05-28 21:13:35,286 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:35,291 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:35,295 [root] DEBUG: Loader: Injecting process 8820 (thread 31968) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:35,296 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:35,297 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:35,299 [lib.api.process] INFO: Injected into 64-bit <Process 8820 dllhost.exe>
2026-05-28 21:13:35,301 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 8820
2026-05-28 21:13:35,303 [lib.api.process] INFO: Monitor config for process 8820: C:\lpw_albt\dll\8820.ini
2026-05-28 21:13:35,304 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:35,308 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:35,312 [root] DEBUG: Loader: Injecting process 8820 (thread 31968) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:35,313 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:35,313 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:35,315 [lib.api.process] INFO: Injected into 64-bit <Process 8820 dllhost.exe>
2026-05-28 21:13:35,323 [root] DEBUG: 8820: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:13:35,324 [root] DEBUG: 8820: Interactive desktop enabled.
2026-05-28 21:13:35,325 [root] DEBUG: 8820: Dropped file limit defaulting to 100.
2026-05-28 21:13:35,327 [root] DEBUG: 8820: Disabling sleep skipping.
2026-05-28 21:13:35,329 [root] DEBUG: 8820: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:13:35,342 [root] DEBUG: 8820: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:13:35,343 [root] DEBUG: 8820: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026
2026-05-28 21:13:35,344 [root] DEBUG: 8820: Monitor initialised: 64-bit capemon loaded in process 8820 at 0x00007FFF18240000, thread 31968, image base 0x00007FF6706B0000, stack from 0x00000024AAAF4000-0x00000024AAB00000
2026-05-28 21:13:35,346 [root] DEBUG: 8820: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-28 21:13:35,358 [root] DEBUG: 8820: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-28 21:13:35,380 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 21:13:35,381 [root] DEBUG: 8820: set_hooks: Unable to hook LockResource
2026-05-28 21:13:35,385 [root] DEBUG: 8820: Hooked 627 out of 628 functions
2026-05-28 21:13:35,386 [root] DEBUG: 8820: Syscall hook installed, syscall logging level 1
2026-05-28 21:13:35,391 [root] DEBUG: 8820: RestoreHeaders: Restored original import table.
2026-05-28 21:13:35,392 [root] INFO: Loaded monitor into process with pid 8820
2026-05-28 21:13:35,393 [root] DEBUG: 8820: caller_dispatch: Added region at 0x00007FF6706B0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6706B12F2, thread 31968).
2026-05-28 21:13:35,394 [root] DEBUG: 8820: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026
2026-05-28 21:13:35,395 [root] DEBUG: 8820: ProcessImageBase: Main module image at 0x00007FF6706B0000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:13:35,397 [root] DEBUG: 8820: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:13:35,399 [root] DEBUG: 8820: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 21:13:35,402 [root] DEBUG: 8820: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:13:35,417 [root] DEBUG: 8820: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:13:35,433 [root] DEBUG: 8820: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 21:13:35,434 [root] DEBUG: 8820: DLL loaded at 0x00007FFF432B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 21:13:35,442 [root] DEBUG: 8820: DLL loaded at 0x00007FFF52860000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 21:13:35,625 [root] INFO: Added new file to list with pid 4484 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
2026-05-28 21:13:35,926 [root] DEBUG: 4484: api-rate-cap: IsDebuggerPresent hook disabled due to rate
2026-05-28 21:13:35,993 [root] INFO: Added new file to list with pid 4484 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
2026-05-28 21:13:36,441 [root] DEBUG: 4484: api-rate-cap: NtClose hook disabled due to rate
2026-05-28 21:13:36,441 [root] DEBUG: 4484: api-rate-cap: NtClose hook disabled due to rate
2026-05-28 21:13:36,442 [root] DEBUG: 4484: api-rate-cap: NtClose hook disabled due to rate
2026-05-28 21:13:36,446 [root] DEBUG: 4484: api-rate-cap: NtClose hook disabled due to rate
2026-05-28 21:13:37,270 [root] DEBUG: 4484: DLL loaded at 0x0000000010670000: C:\Windows\System32\Windows.UI.AppDefaults (0x4c000 bytes).
2026-05-28 21:13:37,271 [root] DEBUG: 4484: DLL loaded at 0x0000000010670000: C:\Windows\System32\Windows.UI.AppDefaults (0x4c000 bytes).
2026-05-28 21:13:37,300 [root] DEBUG: 4484: api-cap: RegQueryValueExW hook disabled due to count: 5000
2026-05-28 21:13:37,344 [root] DEBUG: 4484: api-rate-cap: NtQueryInformationToken hook disabled due to rate
2026-05-28 21:13:37,345 [root] DEBUG: 4484: DLL loaded at 0x00007FFF16060000: C:\Windows\system32\zipfldr (0x4a000 bytes).
2026-05-28 21:13:37,347 [root] DEBUG: 4484: DLL loaded at 0x00007FFF16060000: C:\Windows\system32\zipfldr (0x4a000 bytes).
2026-05-28 21:13:37,421 [root] DEBUG: 4484: DLL loaded at 0x00007FFF467E0000: C:\Windows\System32\Windows.System.Launcher (0xbd000 bytes).
2026-05-28 21:13:37,421 [root] DEBUG: 4484: DLL loaded at 0x00007FFF467E0000: C:\Windows\System32\Windows.System.Launcher (0xbd000 bytes).
2026-05-28 21:13:37,460 [root] DEBUG: 4484: api-cap: RegOpenKeyExW hook disabled due to count: 5000
2026-05-28 21:13:37,461 [root] DEBUG: 4484: api-cap: GetSystemMetrics hook disabled due to count: 5000
2026-05-28 21:13:39,098 [root] DEBUG: 4484: DLL loaded at 0x00007FFF589D0000: C:\Windows\System32\comdlg32 (0xda000 bytes).
2026-05-28 21:13:39,099 [root] DEBUG: 4484: DLL loaded at 0x00007FFF589D0000: C:\Windows\System32\comdlg32 (0xda000 bytes).
2026-05-28 21:13:41,834 [root] INFO: Process with pid 8820 has terminated
2026-05-28 21:13:41,836 [root] DEBUG: 8820: NtTerminateProcess hook: Attempting to dump process 8820
2026-05-28 21:13:41,837 [root] DEBUG: 8820: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:13:42,340 [root] DEBUG: 4484: DLL loaded at 0x0000000010850000: C:\Windows\SYSTEM32\WDSCORE (0x43000 bytes).
2026-05-28 21:13:42,342 [root] DEBUG: 4484: DLL loaded at 0x0000000010850000: C:\Windows\SYSTEM32\WDSCORE (0x43000 bytes).
2026-05-28 21:13:42,343 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4F530000: C:\Windows\system32\winshfhc (0xa000 bytes).
2026-05-28 21:13:42,344 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4F530000: C:\Windows\system32\winshfhc (0xa000 bytes).
2026-05-28 21:13:42,354 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3F830000: C:\Program Files\Windows Defender\MpOav (0x44000 bytes).
2026-05-28 21:13:42,355 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3F830000: C:\Program Files\Windows Defender\MpOav (0x44000 bytes).
2026-05-28 21:13:42,358 [root] DEBUG: 4484: DLL loaded at 0x00007FFF47F70000: C:\Program Files\Windows Defender\MPCLIENT (0xe9000 bytes).
2026-05-28 21:13:42,360 [root] DEBUG: 4484: DLL loaded at 0x00007FFF47F70000: C:\Program Files\Windows Defender\MPCLIENT (0xe9000 bytes).
2026-05-28 21:13:42,362 [root] DEBUG: 4484: api-rate-cap: NtQueryKey hook disabled due to rate
2026-05-28 21:13:42,367 [root] DEBUG: 4484: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 21:13:42,368 [root] DEBUG: 4484: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 21:13:42,377 [root] DEBUG: 4484: api-rate-cap: NtOpenKeyEx hook disabled due to rate
2026-05-28 21:13:42,377 [root] DEBUG: 4484: api-rate-cap: NtOpenKeyEx hook disabled due to rate
2026-05-28 21:13:42,424 [root] DEBUG: 4484: api-cap: RegCloseKey hook disabled due to count: 5001
2026-05-28 21:13:42,425 [root] DEBUG: 4484: api-cap: RegCloseKey hook disabled due to count: 5001
2026-05-28 21:13:42,498 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 35776: C:\Windows\system32\OpenWith.exe, ImageBase: 0x00007FF7025E0000
2026-05-28 21:13:42,500 [root] INFO: Announced 64-bit process name: OpenWith.exe pid: 35776
2026-05-28 21:13:42,502 [lib.api.process] INFO: Monitor config for process 35776: C:\lpw_albt\dll\35776.ini
2026-05-28 21:13:42,854 [root] DEBUG: 4484: api-cap: RegEnumKeyExW hook disabled due to count: 5000
2026-05-28 21:13:43,505 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:43,510 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:43,514 [root] DEBUG: Loader: Injecting process 35776 (thread 35780) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:43,515 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:43,516 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:43,517 [lib.api.process] INFO: Injected into 64-bit <Process 35776 OpenWith.exe>
2026-05-28 21:13:43,520 [root] INFO: Announced 64-bit process name: OpenWith.exe pid: 35776
2026-05-28 21:13:43,521 [lib.api.process] INFO: Monitor config for process 35776: C:\lpw_albt\dll\35776.ini
2026-05-28 21:13:43,522 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:43,528 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:43,532 [root] DEBUG: Loader: Injecting process 35776 (thread 35780) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:43,533 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:43,534 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:43,535 [lib.api.process] INFO: Injected into 64-bit <Process 35776 OpenWith.exe>
2026-05-28 21:13:43,542 [root] DEBUG: 35776: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:13:43,544 [root] DEBUG: 35776: Interactive desktop enabled.
2026-05-28 21:13:43,544 [root] DEBUG: 35776: Dropped file limit defaulting to 100.
2026-05-28 21:13:43,547 [root] DEBUG: 35776: Disabling sleep skipping.
2026-05-28 21:13:43,548 [root] DEBUG: 35776: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:13:43,559 [root] DEBUG: 35776: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:13:43,560 [root] DEBUG: 35776: YaraScan: Scanning 0x00007FF7025E0000, size 0x21176
2026-05-28 21:13:43,562 [root] DEBUG: 35776: Monitor initialised: 64-bit capemon loaded in process 35776 at 0x00007FFF18240000, thread 35780, image base 0x00007FF7025E0000, stack from 0x0000000BCCF94000-0x0000000BCCFA0000
2026-05-28 21:13:43,563 [root] DEBUG: 35776: Commandline: C:\Windows\system32\OpenWith.exe -Embedding
2026-05-28 21:13:43,575 [root] DEBUG: 35776: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-28 21:13:43,595 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 21:13:43,596 [root] DEBUG: 35776: set_hooks: Unable to hook LockResource
2026-05-28 21:13:43,600 [root] DEBUG: 35776: Hooked 627 out of 628 functions
2026-05-28 21:13:43,601 [root] DEBUG: 35776: Syscall hook installed, syscall logging level 1
2026-05-28 21:13:43,607 [root] DEBUG: 35776: RestoreHeaders: Restored original import table.
2026-05-28 21:13:43,607 [root] INFO: Loaded monitor into process with pid 35776
2026-05-28 21:13:43,611 [root] DEBUG: 35776: caller_dispatch: Added region at 0x00007FF7025E0000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF7025EC402, thread 35780).
2026-05-28 21:13:43,612 [root] DEBUG: 35776: YaraScan: Scanning 0x00007FF7025E0000, size 0x21176
2026-05-28 21:13:43,614 [root] DEBUG: 35776: ProcessImageBase: Main module image at 0x00007FF7025E0000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:13:43,616 [root] DEBUG: 35776: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:13:43,617 [root] DEBUG: 35776: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 21:13:43,618 [root] DEBUG: 35776: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:13:43,621 [root] DEBUG: 35776: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:13:43,662 [root] DEBUG: 35776: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 21:13:43,681 [root] DEBUG: 35776: DLL loaded at 0x00007FFF56FA0000: C:\Windows\system32\Wldp (0x2d000 bytes).
2026-05-28 21:13:43,682 [root] DEBUG: 35776: DLL loaded at 0x00007FFF55710000: C:\Windows\system32\windows.storage (0x79b000 bytes).
2026-05-28 21:13:43,693 [root] DEBUG: 35776: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 21:13:43,694 [root] DEBUG: 35776: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:13:43,695 [root] DEBUG: 35776: DLL loaded at 0x00007FFF55220000: C:\Windows\system32\dwmapi (0x2f000 bytes).
2026-05-28 21:13:43,696 [root] DEBUG: 35776: DLL loaded at 0x00007FFF41D40000: C:\Windows\system32\pdh (0x49000 bytes).
2026-05-28 21:13:43,697 [root] DEBUG: 35776: DLL loaded at 0x00007FFF41D90000: C:\Windows\system32\twinui (0x5f4000 bytes).
2026-05-28 21:13:43,699 [root] DEBUG: 35776: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:13:43,705 [root] DEBUG: 35776: DLL loaded at 0x00007FFF48780000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 21:13:43,712 [root] DEBUG: 35776: DLL loaded at 0x00007FFF507C0000: C:\Windows\System32\ActXPrxy (0xa2000 bytes).
2026-05-28 21:13:43,730 [root] DEBUG: 35776: DLL loaded at 0x00007FFF52860000: C:\Windows\system32\PROPSYS (0xf6000 bytes).
2026-05-28 21:13:43,740 [root] DEBUG: 35776: DLL loaded at 0x00007FFF57560000: C:\Windows\system32\profapi (0x25000 bytes).
2026-05-28 21:13:43,744 [root] DEBUG: 35776: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-28 21:13:43,774 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4CBF0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-28 21:13:43,789 [root] INFO: Announced starting service "b'AppMgmt'"
2026-05-28 21:13:44,803 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 35884: C:\Windows\system32\svchost.exe, ImageBase: 0x00007FF7BF220000
2026-05-28 21:13:44,804 [root] INFO: Announced 64-bit process name: svchost.exe pid: 35884
2026-05-28 21:13:44,805 [lib.api.process] INFO: Monitor config for process 35884: C:\lpw_albt\dll\35884.ini
2026-05-28 21:13:44,807 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:44,813 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:44,818 [root] DEBUG: Loader: Injecting process 35884 (thread 35888) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:44,820 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:44,821 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:44,822 [lib.api.process] INFO: Injected into 64-bit <Process 35884 svchost.exe>
2026-05-28 21:13:44,824 [root] INFO: Announced 64-bit process name: svchost.exe pid: 35884
2026-05-28 21:13:44,825 [lib.api.process] INFO: Monitor config for process 35884: C:\lpw_albt\dll\35884.ini
2026-05-28 21:13:44,826 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:44,830 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:44,837 [root] DEBUG: Loader: Injecting process 35884 (thread 35888) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:44,838 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:13:44,839 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:44,842 [lib.api.process] INFO: Injected into 64-bit <Process 35884 svchost.exe>
2026-05-28 21:13:44,843 [root] INFO: Announced 64-bit process name: svchost.exe pid: 35884
2026-05-28 21:13:44,845 [lib.api.process] INFO: Monitor config for process 35884: C:\lpw_albt\dll\35884.ini
2026-05-28 21:13:44,845 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:44,849 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:44,854 [root] DEBUG: Loader: Injecting process 35884 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:44,856 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 35888, handle 0xb8
2026-05-28 21:13:44,857 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:13:44,858 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:44,859 [lib.api.process] INFO: Injected into 64-bit <Process 35884 svchost.exe>
2026-05-28 21:13:44,868 [root] DEBUG: 35884: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:13:44,868 [root] DEBUG: 35884: Interactive desktop enabled.
2026-05-28 21:13:44,869 [root] DEBUG: 35884: Dropped file limit defaulting to 100.
2026-05-28 21:13:44,871 [root] DEBUG: 35884: Disabling sleep skipping.
2026-05-28 21:13:44,872 [root] DEBUG: 35884: Services hook set enabled
2026-05-28 21:13:44,875 [root] DEBUG: 35884: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:13:44,886 [root] DEBUG: 35884: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:13:44,887 [root] DEBUG: 35884: Monitor initialised: 64-bit capemon loaded in process 35884 at 0x00007FFF18240000, thread 35888, image base 0x00007FF7BF220000, stack from 0x000000C322A74000-0x000000C322A80000
2026-05-28 21:13:44,888 [root] DEBUG: 35884: Commandline: C:\Windows\system32\svchost.exe -k netsvcs -p
2026-05-28 21:13:44,902 [root] DEBUG: 35884: Hooked 69 out of 69 functions
2026-05-28 21:13:44,904 [root] DEBUG: 35884: RestoreHeaders: Restored original import table.
2026-05-28 21:13:44,905 [root] INFO: Loaded monitor into process with pid 35884
2026-05-28 21:13:44,907 [root] DEBUG: 35884: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:13:44,908 [root] DEBUG: 35884: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 21:13:44,909 [root] DEBUG: 35884: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:13:44,917 [root] DEBUG: 35884: DLL loaded at 0x00007FFF57520000: c:\windows\system32\USERENV (0x2e000 bytes).
2026-05-28 21:13:44,917 [root] DEBUG: 35884: DLL loaded at 0x00007FFF58800000: C:\Windows\System32\WLDAP32 (0x56000 bytes).
2026-05-28 21:13:44,918 [root] DEBUG: 35884: DLL loaded at 0x00007FFF17B20000: c:\windows\system32\adsldpc (0x44000 bytes).
2026-05-28 21:13:44,919 [root] DEBUG: 35884: DLL loaded at 0x00007FFF4F390000: c:\windows\system32\appmgmts (0x38000 bytes).
2026-05-28 21:13:44,922 [root] DEBUG: 35884: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\WLDP (0x2d000 bytes).
2026-05-28 21:13:45,039 [root] DEBUG: 35776: DLL loaded at 0x000001D0AFD70000: C:\Windows\System32\Windows.UI.AppDefaults (0x4c000 bytes).
2026-05-28 21:13:45,044 [root] DEBUG: 35776: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-28 21:13:45,045 [root] DEBUG: 35776: DLL loaded at 0x00007FFF49D10000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 21:13:45,065 [root] DEBUG: 35776: DLL loaded at 0x00007FFF3CE10000: C:\Windows\System32\uiautomationcore (0x2f5000 bytes).
2026-05-28 21:13:45,071 [root] DEBUG: 35776: DLL loaded at 0x00007FFF42C60000: C:\Windows\System32\DUI70 (0x1ae000 bytes).
2026-05-28 21:13:45,076 [root] DEBUG: 35776: DLL loaded at 0x00007FFF46440000: C:\Windows\System32\DUser (0x95000 bytes).
2026-05-28 21:13:45,108 [root] DEBUG: 35776: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 21:13:45,110 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 35776, handle 0x2f38: C:\Windows\System32\OpenWith.exe
2026-05-28 21:13:45,116 [root] DEBUG: 35776: DLL loaded at 0x00007FFF49A90000: C:\Windows\system32\dwrite (0x27f000 bytes).
2026-05-28 21:13:45,120 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4C870000: C:\Windows\System32\bcp47mrm (0x2d000 bytes).
2026-05-28 21:13:45,125 [root] DEBUG: 35776: DLL loaded at 0x00007FFF51720000: C:\Windows\System32\UIAnimation (0x47000 bytes).
2026-05-28 21:13:45,131 [root] DEBUG: 35776: DLL loaded at 0x00007FFF55EF0000: C:\Windows\System32\dxgi (0xf3000 bytes).
2026-05-28 21:13:45,132 [root] DEBUG: 35776: DLL loaded at 0x00007FFF53070000: C:\Windows\System32\d3d11 (0x263000 bytes).
2026-05-28 21:13:45,138 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4FAA0000: C:\Windows\system32\D3D10Warp (0x6f6000 bytes).
2026-05-28 21:13:45,141 [root] DEBUG: 35776: DLL loaded at 0x00007FFF55120000: C:\Windows\SYSTEM32\resourcepolicyclient (0x14000 bytes).
2026-05-28 21:13:45,152 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4F9D0000: C:\Windows\SYSTEM32\dxcore (0x3b000 bytes).
2026-05-28 21:13:45,155 [root] DEBUG: 35776: DLL loaded at 0x00007FFF538A0000: C:\Windows\SYSTEM32\dcomp (0x1e3000 bytes).
2026-05-28 21:13:45,163 [root] DEBUG: 35776: DLL loaded at 0x00007FFF43990000: C:\Windows\System32\OLEACC (0x66000 bytes).
2026-05-28 21:13:45,169 [root] DEBUG: 35776: DLL loaded at 0x00007FFF47AB0000: C:\Windows\SYSTEM32\edputil (0x24000 bytes).
2026-05-28 21:13:45,175 [root] DEBUG: 35776: DLL loaded at 0x00007FFF517C0000: C:\Windows\SYSTEM32\twinapi.appcore (0x203000 bytes).
2026-05-28 21:13:45,176 [root] DEBUG: 35776: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 21:13:45,177 [root] DEBUG: 35776: DLL loaded at 0x00007FFF51A60000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 21:13:45,178 [root] DEBUG: 35776: DLL loaded at 0x00007FFF54170000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 21:13:45,179 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4B680000: C:\Windows\System32\TextInputFramework (0xf9000 bytes).
2026-05-28 21:13:45,181 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4AF10000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 21:13:45,184 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4BFB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 21:13:45,219 [root] DEBUG: 35776: DLL loaded at 0x00007FFF51B20000: C:\Windows\system32\WindowsCodecs (0x1b4000 bytes).
2026-05-28 21:13:45,232 [root] DEBUG: 35776: api-rate-cap: NtWaitForSingleObject hook disabled due to rate
2026-05-28 21:13:45,234 [root] DEBUG: 35776: api-rate-cap: NtReleaseMutant hook disabled due to rate
2026-05-28 21:13:45,250 [root] DEBUG: 35776: DLL loaded at 0x00007FFF432B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 21:13:45,270 [root] DEBUG: 35776: DLL loaded at 0x00007FFF566C0000: C:\Windows\system32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:13:45,271 [root] DEBUG: 35776: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-28 21:13:45,413 [root] DEBUG: 35776: DLL loaded at 0x00007FFF54E60000: C:\Windows\SYSTEM32\apphelp (0x90000 bytes).
2026-05-28 21:13:45,418 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4C520000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-05-28 21:13:45,419 [root] DEBUG: 35776: DLL loaded at 0x00007FFF56140000: C:\Windows\System32\sppc (0x25000 bytes).
2026-05-28 21:13:45,421 [root] DEBUG: 35776: DLL loaded at 0x00007FFF56170000: C:\Windows\System32\SLC (0x29000 bytes).
2026-05-28 21:13:45,421 [root] DEBUG: 35776: DLL loaded at 0x00007FFF57520000: C:\Windows\System32\USERENV (0x2e000 bytes).
2026-05-28 21:13:45,423 [root] DEBUG: 35776: DLL loaded at 0x00007FFF44BB0000: C:\Windows\System32\appresolver (0x90000 bytes).
2026-05-28 21:13:45,430 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4B780000: C:\Windows\System32\StateRepository.Core (0xb1000 bytes).
2026-05-28 21:13:45,431 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4B840000: C:\Windows\System32\Windows.StateRepository (0x58e000 bytes).
2026-05-28 21:13:45,432 [root] DEBUG: 35776: DLL loaded at 0x00007FFF43150000: C:\Windows\System32\TileDataRepository (0x99000 bytes).
2026-05-28 21:13:45,433 [root] DEBUG: 35776: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\wtsapi32 (0x14000 bytes).
2026-05-28 21:13:45,449 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4CBD0000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-05-28 21:13:45,454 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4CE40000: C:\Windows\System32\MrmCoreR (0xf4000 bytes).
2026-05-28 21:13:45,459 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4F740000: C:\Windows\SYSTEM32\AppxDeploymentClient (0x102000 bytes).
2026-05-28 21:13:45,477 [root] DEBUG: 35776: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 21:13:45,482 [root] DEBUG: 35776: DLL loaded at 0x00007FFF488B0000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-28 21:13:45,487 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 36380: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6706B0000
2026-05-28 21:13:45,488 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 36380
2026-05-28 21:13:45,488 [lib.api.process] INFO: Monitor config for process 36380: C:\lpw_albt\dll\36380.ini
2026-05-28 21:13:45,490 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:45,493 [root] DEBUG: 35776: DLL loaded at 0x00007FFF49830000: C:\Windows\system32\TextShaping (0xac000 bytes).
2026-05-28 21:13:45,497 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:45,504 [root] DEBUG: Loader: Injecting process 36380 (thread 36384) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:45,505 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:45,506 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:45,508 [lib.api.process] INFO: Injected into 64-bit <Process 36380 dllhost.exe>
2026-05-28 21:13:45,509 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 36380
2026-05-28 21:13:45,510 [lib.api.process] INFO: Monitor config for process 36380: C:\lpw_albt\dll\36380.ini
2026-05-28 21:13:45,511 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:13:45,514 [root] DEBUG: 4484: OpenProcessHandler: Image base for process 35776 (handle 0x2e88): 0x00007FF7025E0000.
2026-05-28 21:13:45,518 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:13:45,531 [root] DEBUG: Loader: Injecting process 36380 (thread 36384) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:45,532 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:13:45,533 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:13:45,535 [lib.api.process] INFO: Injected into 64-bit <Process 36380 dllhost.exe>
2026-05-28 21:13:45,541 [root] DEBUG: 36380: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:13:45,542 [root] DEBUG: 36380: Interactive desktop enabled.
2026-05-28 21:13:45,542 [root] DEBUG: 36380: Dropped file limit defaulting to 100.
2026-05-28 21:13:45,545 [root] DEBUG: 36380: Disabling sleep skipping.
2026-05-28 21:13:45,546 [root] DEBUG: 36380: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:13:45,548 [root] DEBUG: 4484: api-rate-cap: SystemParametersInfoW hook disabled due to rate
2026-05-28 21:13:45,559 [root] DEBUG: 36380: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:13:45,559 [root] DEBUG: 36380: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026
2026-05-28 21:13:45,562 [root] DEBUG: 36380: Monitor initialised: 64-bit capemon loaded in process 36380 at 0x00007FFF18240000, thread 36384, image base 0x00007FF6706B0000, stack from 0x000000AF80194000-0x000000AF801A0000
2026-05-28 21:13:45,563 [root] DEBUG: 36380: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-28 21:13:45,575 [root] DEBUG: 36380: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-28 21:13:45,599 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 21:13:45,600 [root] DEBUG: 36380: set_hooks: Unable to hook LockResource
2026-05-28 21:13:45,605 [root] DEBUG: 36380: Hooked 627 out of 628 functions
2026-05-28 21:13:45,606 [root] DEBUG: 36380: Syscall hook installed, syscall logging level 1
2026-05-28 21:13:45,610 [root] DEBUG: 36380: RestoreHeaders: Restored original import table.
2026-05-28 21:13:45,611 [root] INFO: Loaded monitor into process with pid 36380
2026-05-28 21:13:45,612 [root] DEBUG: 36380: caller_dispatch: Added region at 0x00007FF6706B0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6706B12F2, thread 36384).
2026-05-28 21:13:45,613 [root] DEBUG: 36380: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026
2026-05-28 21:13:45,615 [root] DEBUG: 36380: ProcessImageBase: Main module image at 0x00007FF6706B0000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:13:45,618 [root] DEBUG: 36380: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:13:45,619 [root] DEBUG: 36380: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 21:13:45,623 [root] DEBUG: 36380: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:13:45,638 [root] DEBUG: 36380: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:13:45,652 [root] DEBUG: 36380: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 21:13:45,653 [root] DEBUG: 36380: DLL loaded at 0x00007FFF432B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 21:13:45,659 [root] DEBUG: 36380: DLL loaded at 0x00007FFF52860000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 21:13:45,668 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4F740000: C:\Windows\SYSTEM32\AppxDeploymentClient (0x102000 bytes).
2026-05-28 21:13:45,677 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4D6A0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 21:13:45,678 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4D670000: C:\Windows\System32\srvcli (0x28000 bytes).
2026-05-28 21:13:45,679 [root] DEBUG: 35776: DLL loaded at 0x00007FFF56A30000: C:\Windows\System32\netutils (0xc000 bytes).
2026-05-28 21:13:45,681 [root] DEBUG: 35776: DLL loaded at 0x00007FFF4DA40000: C:\Windows\SYSTEM32\urlmon (0x1ed000 bytes).
2026-05-28 21:13:45,762 [root] DEBUG: 35776: DLL loaded at 0x00007FFF47790000: C:\Windows\system32\PhotoMetadataHandler (0x84000 bytes).
2026-05-28 21:13:45,777 [root] DEBUG: 35776: AllocationHandler: Adding allocation to tracked region list: 0x00007DF48AD41000, size: 0x1000.
2026-05-28 21:13:47,480 [root] DEBUG: 35776: FreeHandler: Address: 0x00007DF48AD40000.
2026-05-28 21:13:47,481 [root] DEBUG: 35776: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:13:47,486 [root] INFO: Added new file to list with pid 35776 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
2026-05-28 21:13:47,487 [root] INFO: Added new file to list with pid 35776 and path C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
2026-05-28 21:13:47,496 [root] DEBUG: 35776: NtTerminateProcess hook: Attempting to dump process 35776
2026-05-28 21:13:47,497 [root] DEBUG: 35776: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:13:47,505 [root] DEBUG: 35776: ReverseScanForNonZero: Error - Supplied size zero.
2026-05-28 21:13:47,506 [root] DEBUG: 35776: GetPageAddress: Error - Supplied address zero.
2026-05-28 21:13:47,518 [root] INFO: Process with pid 35776 has terminated
2026-05-28 21:13:49,650 [root] DEBUG: 18964: NtTerminateProcess hook: Attempting to dump process 18964
2026-05-28 21:13:49,651 [root] DEBUG: 18964: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:13:49,654 [root] INFO: Process with pid 18964 has terminated
2026-05-28 21:13:51,246 [root] DEBUG: 4484: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5000
2026-05-28 21:13:51,247 [root] DEBUG: 4484: api-cap: RtlSetCurrentTransaction hook disabled due to count: 5001
2026-05-28 21:13:51,876 [lib.common.results] INFO: Uploading file C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\data.exe_ to files\cf3c015d828784c7dffcba80619dba4cba970680ea5aa9f42f7356e79643a749; Size is 1629184; Max size: 100000000
2026-05-28 21:13:52,475 [root] INFO: Process with pid 36380 has terminated
2026-05-28 21:13:52,476 [root] DEBUG: 36380: NtTerminateProcess hook: Attempting to dump process 36380
2026-05-28 21:13:52,477 [root] DEBUG: 36380: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:13:52,544 [root] DEBUG: 4484: DLL loaded at 0x00007FFF150D0000: C:\Windows\system32\twext (0x33000 bytes).
2026-05-28 21:13:52,546 [root] DEBUG: 4484: DLL loaded at 0x00007FFF150D0000: C:\Windows\system32\twext (0x33000 bytes).
2026-05-28 21:13:52,593 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3FB10000: C:\Windows\System32\shacct (0x29000 bytes).
2026-05-28 21:13:52,594 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3FB10000: C:\Windows\System32\shacct (0x29000 bytes).
2026-05-28 21:13:52,638 [root] DEBUG: 4484: DLL loaded at 0x00007FFF14100000: C:\Program Files\Windows Defender\shellext (0x55000 bytes).
2026-05-28 21:13:52,639 [root] DEBUG: 4484: DLL loaded at 0x00007FFF14100000: C:\Program Files\Windows Defender\shellext (0x55000 bytes).
2026-05-28 21:13:52,734 [root] DEBUG: 4484: DLL loaded at 0x00007FFF162A0000: C:\Windows\System32\sendmail (0x2b000 bytes).
2026-05-28 21:13:52,736 [root] DEBUG: 4484: DLL loaded at 0x00007FFF162A0000: C:\Windows\System32\sendmail (0x2b000 bytes).
2026-05-28 21:13:52,754 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3E220000: C:\Windows\system32\mydocs (0x11000 bytes).
2026-05-28 21:13:52,756 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3E220000: C:\Windows\system32\mydocs (0x11000 bytes).
2026-05-28 21:13:52,833 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4F530000: C:\Windows\System32\drprov (0xb000 bytes).
2026-05-28 21:13:52,835 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4F530000: C:\Windows\System32\drprov (0xb000 bytes).
2026-05-28 21:13:52,836 [root] DEBUG: 4484: DLL loaded at 0x0000000012500000: C:\Windows\System32\ntlanman (0x1f000 bytes).
2026-05-28 21:13:52,837 [root] DEBUG: 4484: DLL loaded at 0x0000000012500000: C:\Windows\System32\ntlanman (0x1f000 bytes).
2026-05-28 21:13:52,840 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4F430000: C:\Windows\System32\DAVHLPR (0xd000 bytes).
2026-05-28 21:13:52,841 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4F430000: C:\Windows\System32\DAVHLPR (0xd000 bytes).
2026-05-28 21:13:52,843 [root] DEBUG: 4484: DLL loaded at 0x0000000012890000: C:\Windows\System32\davclnt (0x1e000 bytes).
2026-05-28 21:13:52,844 [root] DEBUG: 4484: DLL loaded at 0x0000000012890000: C:\Windows\System32\davclnt (0x1e000 bytes).
2026-05-28 21:13:52,851 [root] DEBUG: 4484: api-cap: NtQueryValueKey hook disabled due to count: 5000
2026-05-28 21:13:52,891 [root] DEBUG: 4484: DLL loaded at 0x00007FFF13BE0000: C:\Windows\System32\PlayToDevice (0x64000 bytes).
2026-05-28 21:13:52,893 [root] DEBUG: 4484: DLL loaded at 0x00007FFF13BE0000: C:\Windows\System32\PlayToDevice (0x64000 bytes).
2026-05-28 21:13:52,907 [root] DEBUG: 4484: DLL loaded at 0x00007FFF13BB0000: C:\Windows\System32\EhStorAPI (0x26000 bytes).
2026-05-28 21:13:52,908 [root] DEBUG: 4484: DLL loaded at 0x00007FFF13BB0000: C:\Windows\System32\EhStorAPI (0x26000 bytes).
2026-05-28 21:13:54,568 [root] DEBUG: 4484: DLL loaded at 0x00007FFF162A0000: C:\Windows\SYSTEM32\CHARTV (0x25000 bytes).
2026-05-28 21:13:54,569 [root] DEBUG: 4484: DLL loaded at 0x00007FFF162A0000: C:\Windows\SYSTEM32\CHARTV (0x25000 bytes).
2026-05-28 21:13:54,665 [root] DEBUG: 4484: DLL loaded at 0x00007FFF13B60000: C:\Windows\SYSTEM32\WDSCORE (0x43000 bytes).
2026-05-28 21:13:54,668 [root] DEBUG: 4484: DLL loaded at 0x00007FFF13B60000: C:\Windows\SYSTEM32\WDSCORE (0x43000 bytes).
2026-05-28 21:13:54,669 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4F210000: C:\Windows\system32\winshfhc (0xa000 bytes).
2026-05-28 21:13:54,670 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4F210000: C:\Windows\system32\winshfhc (0xa000 bytes).
2026-05-28 21:13:54,680 [root] DEBUG: 4484: DLL loaded at 0x00007FFF47F70000: C:\Program Files\Windows Defender\MPCLIENT (0xe9000 bytes).
2026-05-28 21:13:54,682 [root] DEBUG: 4484: DLL loaded at 0x00007FFF47F70000: C:\Program Files\Windows Defender\MPCLIENT (0xe9000 bytes).
2026-05-28 21:13:54,765 [root] DEBUG: 4484: api-cap: LdrpCallInitRoutine hook disabled due to count: 5000
2026-05-28 21:13:55,260 [root] DEBUG: 4484: api-cap: GetSystemTimeAsFileTime hook disabled due to count: 5000
2026-05-28 21:14:00,545 [root] DEBUG: 4484: api-cap: NtOpenProcessToken hook disabled due to count: 5000
2026-05-28 21:14:00,551 [root] DEBUG: 4484: api-cap: NtOpenProcessToken hook disabled due to count: 5001
2026-05-28 21:14:01,732 [root] DEBUG: 4484: DLL loaded at 0x00007FFF46F60000: C:\Windows\System32\Windows.Shell.ServiceHostBuilder (0x1d000 bytes).
2026-05-28 21:14:01,733 [root] DEBUG: 4484: DLL loaded at 0x00007FFF46F60000: C:\Windows\System32\Windows.Shell.ServiceHostBuilder (0x1d000 bytes).
2026-05-28 21:14:01,749 [root] DEBUG: 4484: AllocationHandler: Allocation already in tracked region list: 0x00007DF4AE130000.
2026-05-28 21:14:01,753 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE111000, size: 0x1000.
2026-05-28 21:14:01,756 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE101000, size: 0x1000.
2026-05-28 21:14:01,776 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE0F1000, size: 0x1000.
2026-05-28 21:14:01,783 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3F270000: C:\Windows\system32\activationclient (0x12000 bytes).
2026-05-28 21:14:01,785 [root] DEBUG: 4484: DLL loaded at 0x00007FFF3F270000: C:\Windows\system32\activationclient (0x12000 bytes).
2026-05-28 21:14:01,799 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 7824: C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe, ImageBase: 0x00007FF6A5660000
2026-05-28 21:14:01,801 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 7824
2026-05-28 21:14:01,803 [lib.api.process] INFO: Monitor config for process 7824: C:\lpw_albt\dll\7824.ini
2026-05-28 21:14:01,805 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:01,810 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:01,815 [root] DEBUG: Loader: Injecting process 7824 (thread 3772) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:01,817 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:01,818 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:01,819 [lib.api.process] INFO: Injected into 64-bit <Process 7824 CHXSmartScreen.exe>
2026-05-28 21:14:01,821 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 7824
2026-05-28 21:14:01,822 [lib.api.process] INFO: Monitor config for process 7824: C:\lpw_albt\dll\7824.ini
2026-05-28 21:14:01,823 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:01,831 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:01,837 [root] DEBUG: Loader: Injecting process 7824 (thread 3772) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:01,838 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:01,839 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:01,841 [lib.api.process] INFO: Injected into 64-bit <Process 7824 CHXSmartScreen.exe>
2026-05-28 21:14:01,843 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 7824
2026-05-28 21:14:01,843 [lib.api.process] INFO: Monitor config for process 7824: C:\lpw_albt\dll\7824.ini
2026-05-28 21:14:01,844 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:01,852 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:01,857 [root] DEBUG: Loader: Injecting process 7824 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:01,858 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 3772, handle 0x124
2026-05-28 21:14:01,858 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:01,859 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:01,861 [lib.api.process] INFO: Injected into 64-bit <Process 7824 CHXSmartScreen.exe>
2026-05-28 21:14:01,954 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 39036, handle 0x3338: C:\Windows\System32\rundll32.exe
2026-05-28 21:14:02,174 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE0F0000.
2026-05-28 21:14:02,182 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:02,185 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE110000.
2026-05-28 21:14:02,187 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:02,188 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE100000.
2026-05-28 21:14:02,191 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:02,194 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE120000.
2026-05-28 21:14:02,195 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:02,197 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE130000.
2026-05-28 21:14:02,198 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:05,157 [root] DEBUG: 4484: AllocationHandler: Allocation already in tracked region list: 0x00007DF4AE130000.
2026-05-28 21:14:05,159 [root] DEBUG: 4484: AllocationHandler: Allocation already in tracked region list: 0x00007DF4AE120000.
2026-05-28 21:14:05,161 [root] DEBUG: 4484: AllocationHandler: Allocation already in tracked region list: 0x00007DF4AE110000.
2026-05-28 21:14:05,163 [root] DEBUG: 4484: AllocationHandler: Allocation already in tracked region list: 0x00007DF4AE100000.
2026-05-28 21:14:05,195 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 39424: C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe, ImageBase: 0x00007FF6A5660000
2026-05-28 21:14:05,197 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 39424
2026-05-28 21:14:05,199 [lib.api.process] INFO: Monitor config for process 39424: C:\lpw_albt\dll\39424.ini
2026-05-28 21:14:05,201 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:05,207 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:05,212 [root] DEBUG: Loader: Injecting process 39424 (thread 39428) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:05,215 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:05,216 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:05,218 [lib.api.process] INFO: Injected into 64-bit <Process 39424 CHXSmartScreen.exe>
2026-05-28 21:14:05,220 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 39424
2026-05-28 21:14:05,221 [lib.api.process] INFO: Monitor config for process 39424: C:\lpw_albt\dll\39424.ini
2026-05-28 21:14:05,222 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:05,231 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:05,236 [root] DEBUG: Loader: Injecting process 39424 (thread 39428) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:05,237 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:05,238 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:05,241 [lib.api.process] INFO: Injected into 64-bit <Process 39424 CHXSmartScreen.exe>
2026-05-28 21:14:05,244 [root] INFO: Announced 64-bit process name: CHXSmartScreen.exe pid: 39424
2026-05-28 21:14:05,245 [lib.api.process] INFO: Monitor config for process 39424: C:\lpw_albt\dll\39424.ini
2026-05-28 21:14:05,247 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:05,252 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:05,257 [root] DEBUG: Loader: Injecting process 39424 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:05,258 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 39428, handle 0x120
2026-05-28 21:14:05,260 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:05,261 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:05,263 [lib.api.process] INFO: Injected into 64-bit <Process 39424 CHXSmartScreen.exe>
2026-05-28 21:14:05,303 [root] DEBUG: 4484: api-cap: NtWaitForSingleObject hook disabled due to count: 5000
2026-05-28 21:14:05,490 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE0F0000.
2026-05-28 21:14:05,491 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:05,495 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE110000.
2026-05-28 21:14:05,496 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:05,497 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE100000.
2026-05-28 21:14:05,498 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:05,500 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE120000.
2026-05-28 21:14:05,501 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:05,503 [root] DEBUG: 4484: FreeHandler: Address: 0x00007DF4AE130000.
2026-05-28 21:14:05,505 [root] DEBUG: 4484: ScanForNonZero: Error - Supplied size zero.
2026-05-28 21:14:10,934 [root] DEBUG: 4484: OpenProcessHandler: Image base for process 3976 (handle 0x34cc): 0x00007FF7BF860000.
2026-05-28 21:14:10,937 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 3976, handle 0x34cc: C:\Windows\System32\conhost.exe
2026-05-28 21:14:18,204 [root] DEBUG: 4484: CreateProcessHandler: Injection info set for new process 39860: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:18,204 [root] INFO: Announced 64-bit process name: chrome.exe pid: 39860
2026-05-28 21:14:18,205 [lib.api.process] INFO: Monitor config for process 39860: C:\lpw_albt\dll\39860.ini
2026-05-28 21:14:18,207 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:18,215 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:18,220 [root] DEBUG: Loader: Injecting process 39860 (thread 39864) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:18,222 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:18,222 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:18,224 [lib.api.process] INFO: Injected into 64-bit <Process 39860 chrome.exe>
2026-05-28 21:14:18,229 [root] INFO: Announced 64-bit process name: chrome.exe pid: 39860
2026-05-28 21:14:18,230 [lib.api.process] INFO: Monitor config for process 39860: C:\lpw_albt\dll\39860.ini
2026-05-28 21:14:18,231 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:18,240 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:18,244 [root] DEBUG: Loader: Injecting process 39860 (thread 39864) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:18,246 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:18,248 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:18,249 [lib.api.process] INFO: Injected into 64-bit <Process 39860 chrome.exe>
2026-05-28 21:14:18,266 [root] DEBUG: 39860: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:18,268 [root] DEBUG: 39860: Interactive desktop enabled.
2026-05-28 21:14:18,270 [root] DEBUG: 39860: Dropped file limit defaulting to 100.
2026-05-28 21:14:18,276 [root] DEBUG: 39860: Chrome-specific hook-set enabled.
2026-05-28 21:14:18,282 [root] DEBUG: 39860: Disabling sleep skipping.
2026-05-28 21:14:18,284 [root] DEBUG: 39860: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:18,298 [root] DEBUG: 39860: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:14:18,299 [root] DEBUG: 39860: Monitor initialised: 64-bit capemon loaded in process 39860 at 0x00007FFF18240000, thread 39864, image base 0x00007FF7AD300000, stack from 0x000000B94FBF4000-0x000000B94FC00000
2026-05-28 21:14:18,301 [root] DEBUG: 39860: Commandline: "C:\Program Files\Google\Chrome\Application\chrome.exe"
2026-05-28 21:14:18,316 [root] DEBUG: 39860: Hooked 2 out of 2 functions
2026-05-28 21:14:18,348 [root] DEBUG: 39860: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:18,354 [root] DEBUG: 39860: RestoreHeaders: Restored original import table.
2026-05-28 21:14:18,355 [root] INFO: Loaded monitor into process with pid 39860
2026-05-28 21:14:18,356 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 21:14:18,364 [root] DEBUG: 39860: InstrumentationCallback: Added region at 0x00007FFF13BA0014 (base 0x00007FFF138F0000) to tracked regions list (thread 39864).
2026-05-28 21:14:18,368 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,370 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56770000: C:\Windows\system32\ntmarta (0x33000 bytes).
2026-05-28 21:14:18,374 [root] DEBUG: 39860: caller_dispatch: Added region at 0x00007FF7AD300000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7AD3372AF, thread 39864).
2026-05-28 21:14:18,379 [root] DEBUG: 39860: ProcessImageBase: Main module image at 0x00007FF7AD300000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:18,384 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266183e+00 (from 6.266012e+00)
2026-05-28 21:14:18,386 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,391 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266183e+00 (from 6.266012e+00)
2026-05-28 21:14:18,393 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,395 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-28 21:14:18,398 [root] DEBUG: 39860: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-28 21:14:18,403 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266183e+00 (from 6.266012e+00)
2026-05-28 21:14:18,404 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,406 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 39448: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:18,408 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 39448
2026-05-28 21:14:18,413 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266183e+00 (from 6.266012e+00)
2026-05-28 21:14:18,415 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,417 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 39448
2026-05-28 21:14:18,430 [root] DEBUG: 4484: OpenProcessHandler: Injection info created for process 39448, handle 0x36a0: C:\Program Files\Google\Chrome\Application\chrome.exe
2026-05-28 21:14:18,435 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266409e+00 (from 6.266012e+00)
2026-05-28 21:14:18,436 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,534 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266407e+00 (from 6.266012e+00)
2026-05-28 21:14:18,536 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,542 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266409e+00 (from 6.266012e+00)
2026-05-28 21:14:18,543 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,548 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266408e+00 (from 6.266012e+00)
2026-05-28 21:14:18,549 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,553 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266409e+00 (from 6.266012e+00)
2026-05-28 21:14:18,554 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,555 [root] DEBUG: 39860: DLL loaded at 0x00007FFF453C0000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-28 21:14:18,556 [root] DEBUG: 39860: DLL loaded at 0x00007FFF49A90000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-28 21:14:18,557 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57350000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-28 21:14:18,558 [root] DEBUG: 39860: DLL loaded at 0x00007FFEEAF40000: C:\Program Files\Google\Chrome\Application\148.0.7778.217\chrome (0x10fdc000 bytes).
2026-05-28 21:14:18,564 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266408e+00 (from 6.266012e+00)
2026-05-28 21:14:18,565 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,571 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266408e+00 (from 6.266012e+00)
2026-05-28 21:14:18,573 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,574 [root] DEBUG: 39860: DLL loaded at 0x00007FFF45010000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-28 21:14:18,580 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,581 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,587 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,594 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,596 [root] DEBUG: 39860: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:14:18,604 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,605 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,606 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57520000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-28 21:14:18,611 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,612 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,613 [root] DEBUG: 39860: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-28 21:14:18,620 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266411e+00 (from 6.266012e+00)
2026-05-28 21:14:18,622 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,625 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-28 21:14:18,633 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,637 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,639 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-28 21:14:18,648 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,648 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,654 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,655 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,660 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,662 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,666 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266410e+00 (from 6.266012e+00)
2026-05-28 21:14:18,667 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,674 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266412e+00 (from 6.266012e+00)
2026-05-28 21:14:18,678 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,678 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266412e+00 (from 6.266012e+00)
2026-05-28 21:14:18,680 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266412e+00 (from 6.266012e+00)
2026-05-28 21:14:18,681 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266412e+00 (from 6.266012e+00)
2026-05-28 21:14:18,683 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,684 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,685 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,687 [root] DEBUG: 39860: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-28 21:14:18,693 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266413e+00 (from 6.266012e+00)
2026-05-28 21:14:18,695 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,696 [root] DEBUG: 39860: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:14:18,701 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266413e+00 (from 6.266012e+00)
2026-05-28 21:14:18,703 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,705 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:14:18,710 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266441e+00 (from 6.266012e+00)
2026-05-28 21:14:18,713 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,720 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:14:18,726 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266444e+00 (from 6.266012e+00)
2026-05-28 21:14:18,727 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266444e+00 (from 6.266012e+00)
2026-05-28 21:14:18,728 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,729 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,733 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,734 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,735 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,736 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,736 [root] DEBUG: 39860: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:14:18,737 [root] DEBUG: 39860: DLL loaded at 0x00007FFF18820000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-28 21:14:18,742 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266442e+00 (from 6.266012e+00)
2026-05-28 21:14:18,744 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266442e+00 (from 6.266012e+00)
2026-05-28 21:14:18,745 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,747 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,752 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,754 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,756 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,758 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,761 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,761 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,769 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,772 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,777 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,778 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,783 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,784 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,786 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 21:14:18,788 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57010000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-28 21:14:18,789 [root] DEBUG: 39860: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:14:18,790 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 21:14:18,792 [root] DEBUG: 39860: DLL loaded at 0x00007FFF15300000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-28 21:14:18,794 [root] DEBUG: 39860: DLL loaded at 0x00007FFF187E0000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-28 21:14:18,798 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,799 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,801 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56FD0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-28 21:14:18,808 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,810 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,811 [root] DEBUG: 39860: DLL loaded at 0x00007FFF44D50000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-28 21:14:18,815 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,817 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,823 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,825 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,826 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,829 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,831 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,831 [root] DEBUG: 39860: DLL loaded at 0x00007FFF569F0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-28 21:14:18,833 [root] DEBUG: 39860: DLL loaded at 0x00007FFF52960000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-28 21:14:18,838 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266441e+00 (from 6.266012e+00)
2026-05-28 21:14:18,840 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,842 [root] DEBUG: 39860: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\netapi32 (0x19000 bytes).
2026-05-28 21:14:18,849 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,851 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,852 [root] DEBUG: 39860: DLL loaded at 0x00007FFF58B20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-28 21:14:18,856 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266443e+00 (from 6.266012e+00)
2026-05-28 21:14:18,859 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,865 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266441e+00 (from 6.266012e+00)
2026-05-28 21:14:18,869 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,877 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266439e+00 (from 6.266012e+00)
2026-05-28 21:14:18,879 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,882 [root] DEBUG: 39860: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-28 21:14:18,883 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-28 21:14:18,885 [root] DEBUG: 39860: DLL loaded at 0x00007FFF52F20000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-28 21:14:18,890 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266441e+00 (from 6.266012e+00)
2026-05-28 21:14:18,891 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,893 [root] DEBUG: 39860: DLL loaded at 0x00007FFF515C0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-28 21:14:18,897 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266440e+00 (from 6.266012e+00)
2026-05-28 21:14:18,899 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,903 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57560000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-28 21:14:18,907 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266441e+00 (from 6.266012e+00)
2026-05-28 21:14:18,909 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,911 [root] DEBUG: 39860: DLL loaded at 0x00007FFF515A0000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-28 21:14:18,918 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266444e+00 (from 6.266012e+00)
2026-05-28 21:14:18,919 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,920 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56A40000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-28 21:14:18,926 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:18,928 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,929 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:18,931 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,933 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:18,935 [root] DEBUG: 39860: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\netapi32 (0x19000 bytes).
2026-05-28 21:14:18,935 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,941 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:18,943 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:18,945 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,947 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,949 [root] DEBUG: 39860: DLL loaded at 0x00007FFF48330000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-28 21:14:18,950 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:18,952 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,957 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:18,958 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,960 [root] DEBUG: 39860: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:14:18,967 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266445e+00 (from 6.266012e+00)
2026-05-28 21:14:18,969 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,975 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266445e+00 (from 6.266012e+00)
2026-05-28 21:14:18,977 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,983 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266445e+00 (from 6.266012e+00)
2026-05-28 21:14:18,984 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:18,992 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:18,995 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,000 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,003 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,007 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,009 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,011 [root] DEBUG: 39860: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-28 21:14:19,012 [root] DEBUG: 39860: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-28 21:14:19,013 [root] DEBUG: 39860: DLL loaded at 0x00007FFF54170000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-28 21:14:19,014 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4B680000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-28 21:14:19,022 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,023 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,026 [root] DEBUG: 39860: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-28 21:14:19,031 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,032 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,034 [root] DEBUG: 39860: DLL loaded at 0x00007FFF45580000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-28 21:14:19,039 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,039 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,045 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266445e+00 (from 6.266012e+00)
2026-05-28 21:14:19,046 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,054 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266445e+00 (from 6.266012e+00)
2026-05-28 21:14:19,057 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,062 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266445e+00 (from 6.266012e+00)
2026-05-28 21:14:19,063 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,069 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266445e+00 (from 6.266012e+00)
2026-05-28 21:14:19,071 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,072 [root] DEBUG: 39860: DLL loaded at 0x00007FFF52420000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-28 21:14:19,078 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,079 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,089 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,092 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,096 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,097 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,104 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,106 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,114 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,115 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,117 [root] DEBUG: 39860: DLL loaded at 0x00007FFF51A60000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-28 21:14:19,119 [root] DEBUG: 39860: DLL loaded at 0x00007FFF52860000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-05-28 21:14:19,119 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4AF10000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-28 21:14:19,120 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4BFB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-28 21:14:19,127 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,128 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,129 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,130 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,131 [root] DEBUG: 39860: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-28 21:14:19,136 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,138 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,138 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,140 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,146 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,149 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,151 [root] DEBUG: 39860: DLL loaded at 0x00007FFF515E0000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-28 21:14:19,153 [root] DEBUG: 39860: DLL loaded at 0x00007FFF51600000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-28 21:14:19,158 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,159 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,160 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,162 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,163 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 21:14:19,168 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,170 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,171 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,172 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,172 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,174 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,178 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,179 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,180 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266446e+00 (from 6.266012e+00)
2026-05-28 21:14:19,183 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,184 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,184 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,186 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 40792: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:19,187 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 40792
2026-05-28 21:14:19,189 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,190 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,190 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,192 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,194 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,195 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 21:14:19,195 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,196 [root] DEBUG: 39860: DLL loaded at 0x00007FFF572F0000: C:\Windows\System32\DEVOBJ (0x33000 bytes).
2026-05-28 21:14:19,197 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 40792
2026-05-28 21:14:19,205 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,207 [root] DEBUG: 39860: DLL loaded at 0x00007FFF50520000: C:\Windows\System32\MMDevApi (0x85000 bytes).
2026-05-28 21:14:19,208 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,212 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266447e+00 (from 6.266012e+00)
2026-05-28 21:14:19,217 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,218 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,221 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,221 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,223 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,226 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,227 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,231 [root] INFO: Announced starting service "b'GoogleChromeElevationService'"
2026-05-28 21:14:19,232 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,232 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 40916: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:19,233 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,233 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 40916
2026-05-28 21:14:19,236 [root] DEBUG: 39860: DLL loaded at 0x00007FFF52560000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-28 21:14:19,239 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,242 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,244 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,245 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,248 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 40916
2026-05-28 21:14:19,254 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,258 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,259 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:19,261 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,262 [root] DEBUG: 39860: DLL loaded at 0x00007FFF49D10000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-28 21:14:19,269 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,270 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,284 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,286 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,291 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 41068: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:19,292 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,294 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,294 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,295 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,296 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 41068
2026-05-28 21:14:19,297 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,301 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,306 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,323 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,325 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,328 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,329 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,330 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,335 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,337 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,339 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,340 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,341 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,343 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,343 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,347 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,350 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,352 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,354 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,356 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,357 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,358 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266449e+00 (from 6.266012e+00)
2026-05-28 21:14:19,360 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 41068
2026-05-28 21:14:19,361 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,367 [root] DEBUG: 39860: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-28 21:14:19,372 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,373 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,374 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,375 [root] DEBUG: 39860: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-28 21:14:19,375 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,382 [root] DEBUG: 39860: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-28 21:14:19,383 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,384 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,387 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,388 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,390 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,390 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,395 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,396 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,401 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,402 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,402 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,408 [root] DEBUG: 39860: DLL loaded at 0x00007FFF19960000: C:\Windows\System32\CryptoWinRT (0x61000 bytes).
2026-05-28 21:14:19,414 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266476e+00 (from 6.266012e+00)
2026-05-28 21:14:19,415 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,416 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,417 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,419 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,422 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,422 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,426 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,429 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57010000: C:\Windows\System32\ncrypt (0x27000 bytes).
2026-05-28 21:14:19,431 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,432 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,433 [root] DEBUG: 39860: DLL loaded at 0x00007FFF51040000: C:\Windows\System32\cryptngc (0x77000 bytes).
2026-05-28 21:14:19,439 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,439 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,440 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,443 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,444 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56FD0000: C:\Windows\System32\NTASN1 (0x3b000 bytes).
2026-05-28 21:14:19,448 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266480e+00 (from 6.266012e+00)
2026-05-28 21:14:19,448 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,450 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266480e+00 (from 6.266012e+00)
2026-05-28 21:14:19,451 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,452 [root] DEBUG: 39860: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-28 21:14:19,454 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,456 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,460 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,462 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,464 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,465 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,469 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266480e+00 (from 6.266012e+00)
2026-05-28 21:14:19,469 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266480e+00 (from 6.266012e+00)
2026-05-28 21:14:19,473 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,475 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,478 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266480e+00 (from 6.266012e+00)
2026-05-28 21:14:19,480 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,481 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266480e+00 (from 6.266012e+00)
2026-05-28 21:14:19,484 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,488 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266480e+00 (from 6.266012e+00)
2026-05-28 21:14:19,492 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,495 [root] DEBUG: 39860: DLL loaded at 0x00007FFF55EF0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-28 21:14:19,496 [root] DEBUG: 39860: DLL loaded at 0x00007FFF53070000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-28 21:14:19,498 [root] DEBUG: 39860: DLL loaded at 0x00007FFF538A0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-28 21:14:19,499 [root] DEBUG: 39860: DLL loaded at 0x00007FFF43630000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-28 21:14:19,503 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,505 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,506 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,508 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,510 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56250000: C:\Windows\System32\FirewallAPI (0x96000 bytes).
2026-05-28 21:14:19,511 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,512 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,514 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,515 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,517 [root] DEBUG: 39860: DLL loaded at 0x00007FFF561E0000: C:\Windows\System32\fwbase (0x36000 bytes).
2026-05-28 21:14:19,517 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266477e+00 (from 6.266012e+00)
2026-05-28 21:14:19,519 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,523 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266477e+00 (from 6.266012e+00)
2026-05-28 21:14:19,526 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,528 [root] DEBUG: 39860: DLL loaded at 0x00007FFF19930000: C:\Windows\system32\ngcksp (0x27000 bytes).
2026-05-28 21:14:19,528 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,530 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,533 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,534 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,535 [root] DEBUG: 39860: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-28 21:14:19,539 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,541 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,548 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,549 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,554 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,555 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,556 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,557 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,558 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,559 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,560 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,561 [root] DEBUG: 39860: DLL loaded at 0x00007FFF1EF30000: C:\Windows\System32\Windows.Media (0x726000 bytes).
2026-05-28 21:14:19,562 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,567 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,569 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,569 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,570 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,574 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,575 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,576 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,578 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,581 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,582 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,588 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,588 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,590 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266478e+00 (from 6.266012e+00)
2026-05-28 21:14:19,590 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,591 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,592 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,595 [root] DEBUG: 39860: DLL loaded at 0x00007FFF43590000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-28 21:14:19,597 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 41764: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:19,598 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,599 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 41764
2026-05-28 21:14:19,601 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,602 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,603 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,604 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,605 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,606 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,607 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 41808: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:19,608 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,610 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 41808
2026-05-28 21:14:19,610 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,611 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,612 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,617 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 41764
2026-05-28 21:14:19,618 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,619 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,620 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,621 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,622 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,623 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 41808
2026-05-28 21:14:19,624 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,624 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,626 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,626 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,627 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,633 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,634 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,634 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,635 [root] DEBUG: 39860: DLL loaded at 0x00007FFF43990000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-28 21:14:19,637 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,637 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,640 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,641 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,647 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,649 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,650 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,652 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,654 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,657 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,657 [root] DEBUG: 39860: DLL loaded at 0x00007FFF488B0000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-28 21:14:19,665 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,667 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,670 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,674 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,675 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,679 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,684 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,688 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,689 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,699 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,710 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,714 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,716 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,721 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,722 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,724 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,727 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,727 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,731 [root] DEBUG: 39860: DLL loaded at 0x00007FFF55220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-28 21:14:19,732 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,736 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,738 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:19,738 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,742 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,743 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,744 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,746 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,747 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,747 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,752 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,753 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,755 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,756 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,756 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,757 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,769 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 42180: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:19,771 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,772 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,773 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,774 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,779 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,781 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 42180
2026-05-28 21:14:19,781 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,783 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,784 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:19,785 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,786 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4F950000: C:\Windows\system32\wlanapi (0x74000 bytes).
2026-05-28 21:14:19,788 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,789 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,792 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,792 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 42260: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:19,794 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,795 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 42260
2026-05-28 21:14:19,796 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 42180
2026-05-28 21:14:19,800 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,801 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,803 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,804 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,805 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,806 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,806 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,806 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,811 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,812 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 42260
2026-05-28 21:14:19,813 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,816 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,817 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,819 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,819 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,825 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,826 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,827 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,827 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,829 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,834 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,835 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,844 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,851 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,855 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,856 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,856 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,857 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,862 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,865 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 42452: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:19,874 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,877 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,877 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 42452
2026-05-28 21:14:19,878 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,880 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,892 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,899 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,899 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,901 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,902 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 42452
2026-05-28 21:14:19,905 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,911 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,911 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,912 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,914 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,915 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,916 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,918 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,920 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,921 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,926 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,927 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,940 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,940 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,942 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,943 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,944 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,945 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,945 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,947 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57130000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-28 21:14:19,948 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,948 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,949 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,954 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,955 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,961 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,962 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,963 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,965 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,967 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,967 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,969 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,970 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,971 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,972 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,980 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,981 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,981 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,989 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,993 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,995 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-28 21:14:19,996 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:19,997 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,998 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:19,999 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,004 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,006 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,007 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,009 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,009 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,010 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,010 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,012 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,012 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,016 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56630000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-28 21:14:20,017 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,020 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,021 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,022 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,022 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,023 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,024 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,037 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,038 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,039 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,039 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,046 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,049 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,050 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,055 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,056 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,055 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,065 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,066 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,068 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,069 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,075 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,076 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,081 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,082 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,087 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,088 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,093 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,093 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,097 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,100 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,104 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,106 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,110 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,112 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,117 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,117 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,123 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,124 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,129 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,131 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,136 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,137 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,143 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,144 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,149 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,150 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,155 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,156 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,161 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,162 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,168 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,168 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,172 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,174 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,178 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,181 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,185 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,187 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,192 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,193 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,198 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,200 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,206 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,207 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,212 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,213 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,218 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,219 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,225 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,227 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,231 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,232 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,236 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,238 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,239 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 43116: C:\Program Files\Google\Chrome\Application\148.0.7778.217\elevation_service.exe, ImageBase: 0x00007FF717E20000
2026-05-28 21:14:20,240 [root] INFO: Announced 64-bit process name: elevation_service.exe pid: 43116
2026-05-28 21:14:20,241 [lib.api.process] INFO: Monitor config for process 43116: C:\lpw_albt\dll\43116.ini
2026-05-28 21:14:20,243 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,243 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:20,245 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,252 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,254 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,260 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,262 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,263 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,264 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,268 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,269 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,270 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,271 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,277 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,279 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,280 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,282 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,283 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,284 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,286 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,290 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,293 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,294 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,296 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,297 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,298 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,300 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,304 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,306 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,310 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,312 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,316 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,317 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,323 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,325 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,335 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,336 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,342 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,345 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,355 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,356 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,365 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,367 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,368 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,370 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,372 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,374 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,376 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,386 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,386 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,389 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,390 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,394 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,401 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,402 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,403 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,405 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,407 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,412 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,416 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 43396: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:20,416 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,418 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,417 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,418 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 43396
2026-05-28 21:14:20,421 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,422 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,423 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,424 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,426 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,427 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,428 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,429 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,432 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,434 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,436 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,437 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 43396
2026-05-28 21:14:20,438 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,439 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,441 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,448 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,448 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,450 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,450 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,451 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,452 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,454 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,453 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,456 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,465 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,466 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,466 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,468 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,470 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,471 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,473 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,474 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,475 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,478 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,479 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,481 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,488 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,488 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,490 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,492 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,497 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,498 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,501 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,502 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,504 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,508 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,511 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,512 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,514 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,515 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,516 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,517 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,520 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,521 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,522 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,523 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,526 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,527 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,529 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,530 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,532 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,534 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,536 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,536 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,542 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,543 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,547 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,548 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,556 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,557 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,563 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,566 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,573 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,575 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,580 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,581 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,609 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,614 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,615 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,619 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,621 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,622 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,633 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,634 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,642 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,642 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,648 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,649 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,651 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,652 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,657 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,659 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,659 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,662 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,667 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,670 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,672 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,673 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,674 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,677 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,681 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,682 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,698 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,699 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,704 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,706 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:20,709 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:20,710 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,154 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 21:14:21,168 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:21,174 [root] DEBUG: Loader: Injecting process 43116 (thread 43120) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:21,175 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:21,177 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:21,179 [lib.api.process] INFO: Injected into 64-bit <Process 43116 elevation_service.exe>
2026-05-28 21:14:21,182 [root] INFO: Announced 64-bit process name: elevation_service.exe pid: 43116
2026-05-28 21:14:21,183 [lib.api.process] INFO: Monitor config for process 43116: C:\lpw_albt\dll\43116.ini
2026-05-28 21:14:21,184 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:21,739 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,740 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,742 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,744 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,748 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,750 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,751 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,753 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,758 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,759 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,763 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,764 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,771 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,772 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,778 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,780 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,781 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,783 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,788 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,790 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,798 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,800 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,805 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,806 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,829 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,831 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,835 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,837 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,843 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,845 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,849 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,850 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,857 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,858 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,863 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,864 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,871 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,872 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,876 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,878 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,885 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,887 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,892 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,894 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,901 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,902 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,907 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,908 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,918 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,920 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,924 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,926 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,979 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,980 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,982 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,982 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,983 [root] DEBUG: 39860: DLL loaded at 0x00007FFF41D40000: C:\Windows\SYSTEM32\pdh (0x49000 bytes).
2026-05-28 21:14:21,988 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,990 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,991 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:21,992 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,993 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,995 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:21,995 [root] DEBUG: 39860: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\SETUPAPI (0x46e000 bytes).
2026-05-28 21:14:21,998 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,000 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,000 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,001 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,002 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,003 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,003 [root] DEBUG: 39860: DLL loaded at 0x00007FFF54B30000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-05-28 21:14:22,007 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,008 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,008 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,009 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,010 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,011 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,012 [root] DEBUG: 39860: DLL loaded at 0x00007FFF47420000: C:\Windows\System32\Windows.FileExplorer.Common (0x61000 bytes).
2026-05-28 21:14:22,014 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,013 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,017 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,019 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,021 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,022 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,025 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,026 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,027 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,028 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,030 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266480e+00 (from 6.266012e+00)
2026-05-28 21:14:22,031 [root] DEBUG: 39860: DLL loaded at 0x00007FFF57AA0000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-28 21:14:22,032 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,033 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,034 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,037 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,038 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,039 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,040 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,040 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266482e+00 (from 6.266012e+00)
2026-05-28 21:14:22,042 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4F560000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-05-28 21:14:22,043 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,044 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,047 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,049 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:22,050 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:22,051 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:22,054 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,055 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,056 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4D6A0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-28 21:14:22,057 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:22,059 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,060 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,060 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,061 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266479e+00 (from 6.266012e+00)
2026-05-28 21:14:22,065 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,067 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,066 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,070 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,071 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,073 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,074 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,075 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,076 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,078 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,079 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,080 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,082 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,083 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,085 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,088 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,092 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,093 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,095 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,096 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,097 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,099 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,101 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,103 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,105 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,106 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,108 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,110 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,111 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,112 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,115 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,117 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,118 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,120 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,122 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,123 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,124 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,124 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,125 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,128 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,129 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266481e+00 (from 6.266012e+00)
2026-05-28 21:14:22,130 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,134 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,136 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,138 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,140 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,142 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,144 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,146 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,145 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,147 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,149 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,150 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,151 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,154 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,155 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,156 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,159 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,159 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,161 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,162 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,164 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,166 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,167 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,169 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,170 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,173 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,174 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,176 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,178 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,180 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,182 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,183 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,186 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,186 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,188 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,190 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,194 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,195 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,197 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,199 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,202 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,205 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,207 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,208 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,211 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,212 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,214 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,216 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,217 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,220 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,221 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,222 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,225 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,225 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,227 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,233 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,234 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,235 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,237 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,238 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,239 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,241 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,242 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,243 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,246 [root] DEBUG: 39860: DLL loaded at 0x00007FFEE7D30000: C:\Program Files\Google\Chrome\Application\148.0.7778.217\optimization_guide_internal (0x11e2000 bytes).
2026-05-28 21:14:22,248 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,249 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,252 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,256 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,257 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,258 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,260 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,261 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,263 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,265 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,266 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,268 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,268 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,270 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,273 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,275 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,276 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,277 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,278 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,280 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,281 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 44896: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:22,282 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,284 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 44896
2026-05-28 21:14:22,288 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,289 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,290 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,291 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,291 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,294 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,294 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,295 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,296 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,297 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 44896
2026-05-28 21:14:22,298 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,299 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,299 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,304 [root] DEBUG: 39860: DLL loaded at 0x00007FFF56D00000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-05-28 21:14:22,305 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,307 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,310 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,311 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,316 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,317 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,318 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,319 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,320 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,324 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,325 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,326 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,328 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,329 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,330 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,332 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,332 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,334 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,335 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,336 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,340 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,342 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,343 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,345 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,346 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,348 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,349 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,353 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,360 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,361 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,362 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,364 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,365 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,371 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,373 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,375 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,382 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,383 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,385 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,385 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,387 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,387 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,389 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,390 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,391 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,394 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,396 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,397 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,398 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,400 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,401 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,405 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,407 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,409 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,411 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,412 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,413 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,415 [root] DEBUG: 39860: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:14:22,415 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,419 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,422 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4FA10000: C:\Windows\system32\tbs (0x1b000 bytes).
2026-05-28 21:14:22,425 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,427 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,429 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,431 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,432 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,432 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,437 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,442 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,443 [root] DEBUG: 39860: DLL loaded at 0x00007FFF50370000: C:\Windows\system32\PCPKsp (0x118000 bytes).
2026-05-28 21:14:22,444 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,445 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,449 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,450 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,451 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,452 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,452 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,453 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,454 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,456 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,460 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,461 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,462 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,463 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,465 [root] DEBUG: 39860: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-28 21:14:22,466 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,468 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,469 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,469 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-28 21:14:22,473 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,474 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,475 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,477 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,478 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,479 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,482 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 45496: C:\Windows\system32\wbem\wmiprvse.exe, ImageBase: 0x00007FF7BB740000
2026-05-28 21:14:22,483 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,484 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,485 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,486 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,488 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,488 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,492 [root] DEBUG: 39860: DLL loaded at 0x00007FFF45050000: C:\Windows\system32\ncryptprov (0x5a000 bytes).
2026-05-28 21:14:22,492 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,493 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,494 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,495 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 45496
2026-05-28 21:14:22,497 [lib.api.process] INFO: Monitor config for process 45496: C:\lpw_albt\dll\45496.ini
2026-05-28 21:14:22,497 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266436e+00 (from 6.266012e+00)
2026-05-28 21:14:22,498 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,500 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:22,500 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,501 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,502 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,504 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,506 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,507 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,509 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,510 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,511 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,512 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,512 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,514 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,514 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,515 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,516 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,518 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,520 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,521 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,523 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,525 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,526 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,528 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,529 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,530 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,532 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,532 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,535 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,535 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,537 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,539 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,542 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,544 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,544 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,547 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,548 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,548 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,550 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,554 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,556 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,557 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,557 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,559 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,560 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,562 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,564 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,565 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,568 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,568 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,570 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,572 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,574 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,575 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,576 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,576 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,577 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,579 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,579 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,582 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,582 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,584 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,585 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,587 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,588 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,590 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,591 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,593 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,595 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,600 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,602 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,603 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,604 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,606 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,607 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,608 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,610 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,617 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,619 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,622 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,623 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,625 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,627 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,632 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,634 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,636 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,637 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,642 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,643 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,647 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,648 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,654 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,655 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,657 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,659 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,664 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,666 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,667 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,668 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,672 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,675 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,677 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,678 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,683 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,686 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,686 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,687 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,693 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,695 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,696 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,697 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,701 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,703 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,703 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,705 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,708 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,710 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,714 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,716 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,717 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,720 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,722 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,724 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,727 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,729 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,732 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,734 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,735 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,736 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,740 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,743 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,746 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,746 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,752 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,754 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,755 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,757 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,762 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,763 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,765 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,766 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,768 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,770 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,775 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,778 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,779 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,781 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,785 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,786 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,788 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,790 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,793 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,794 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,799 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 21:14:22,799 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,802 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,803 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,806 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,811 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,812 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:22,814 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,816 [root] DEBUG: Loader: Injecting process 43116 (thread 43120) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:22,818 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,820 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:22,821 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,822 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:22,824 [lib.api.process] INFO: Injected into 64-bit <Process 43116 elevation_service.exe>
2026-05-28 21:14:22,824 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,825 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,827 [root] INFO: Announced 64-bit process name: elevation_service.exe pid: 43116
2026-05-28 21:14:22,828 [lib.api.process] INFO: Monitor config for process 43116: C:\lpw_albt\dll\43116.ini
2026-05-28 21:14:22,829 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:22,829 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,830 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,831 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,834 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,836 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,838 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,839 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,841 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,842 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,845 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,847 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,849 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,851 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,853 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,855 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,856 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,857 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,858 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,861 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,864 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,864 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,866 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,870 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,871 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,873 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,873 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,878 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,879 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,880 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,881 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,884 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,886 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,887 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,888 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,890 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,891 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,893 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,895 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,897 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,899 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,901 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,902 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,904 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,906 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,908 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,909 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,912 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,913 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,915 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,916 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,919 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,920 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,922 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,923 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,926 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,927 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,929 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,930 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,933 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,934 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,935 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,937 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,939 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,940 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,944 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,946 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,947 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,948 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,952 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,953 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,955 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,956 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,961 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,961 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,963 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,965 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,966 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,966 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,970 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,971 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,972 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,973 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,978 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,979 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,980 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,982 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,985 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,985 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,986 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,987 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,988 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,990 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,990 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,992 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,994 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,995 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:22,996 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,998 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:22,999 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,000 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,001 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,003 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,005 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,006 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,007 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,008 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,008 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,010 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,014 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,016 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,018 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,020 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,024 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,025 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,027 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,028 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,032 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,033 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,034 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,035 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,038 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,040 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,042 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,042 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,045 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,046 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,048 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,048 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,051 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,052 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,056 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,056 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,058 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,060 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,062 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,063 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,065 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,067 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,069 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,072 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,072 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,073 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,077 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,078 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,079 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,080 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,085 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,086 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,087 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,088 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,091 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,093 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,095 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,096 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,099 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,102 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,104 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,105 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,107 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,108 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,110 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,111 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,113 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,115 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,116 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,117 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,119 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,120 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,123 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,124 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,126 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,127 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,130 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,131 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,133 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,134 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,138 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,139 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,140 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,142 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,146 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,147 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,150 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,151 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,152 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,153 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,154 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,155 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,158 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,159 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,161 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,162 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,165 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,165 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,166 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,168 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,169 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,170 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,171 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,173 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,175 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,176 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,178 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,180 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,181 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,182 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,183 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,184 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,187 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,188 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,189 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,189 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,192 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,193 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,195 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,196 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,199 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,200 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,202 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,203 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,204 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,206 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,211 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,215 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,216 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,217 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,222 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,223 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,224 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,226 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,227 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,228 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,233 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,234 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,238 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,239 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,240 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,242 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,247 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,247 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,248 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,249 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,254 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,256 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,258 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,259 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,261 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,262 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,265 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,266 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,268 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,269 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,274 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,277 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,279 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,281 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,284 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,286 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,288 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,289 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,292 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,293 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,295 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,296 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,298 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,299 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,301 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,303 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,305 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,306 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,309 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,311 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,312 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,314 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,320 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,322 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,330 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,331 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,337 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,339 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,344 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,345 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,350 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,355 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,362 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,363 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,368 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,370 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,375 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,377 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,383 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,384 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,389 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,390 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,395 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,397 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,404 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,405 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,410 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,411 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,416 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,417 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,422 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,423 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,427 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,428 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,435 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,435 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,441 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,443 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,448 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,449 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,453 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,455 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,463 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,465 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,469 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,472 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,476 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,479 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,484 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,485 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,491 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,491 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,498 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,500 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,504 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,506 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,510 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,511 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,517 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,519 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,525 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,526 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,531 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,533 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,538 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,540 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,544 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,545 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,550 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,551 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,556 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,558 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,563 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,564 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,569 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,570 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,575 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,576 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,581 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,581 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,586 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,588 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,593 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,594 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,600 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,601 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,607 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,609 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,614 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,616 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,621 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,623 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,629 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,631 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,637 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,638 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,643 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,645 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,650 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,651 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,656 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,658 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,663 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,665 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,670 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,672 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,677 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,678 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,684 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,685 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,693 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,694 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,699 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,700 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,706 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,708 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,714 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,715 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,720 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,721 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,726 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,728 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,732 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,734 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,740 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,742 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,747 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,748 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,753 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,755 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,760 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,762 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,767 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,768 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,774 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,776 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,781 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,783 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,789 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,790 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,795 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,796 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,800 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,802 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,809 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,811 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,817 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,817 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,823 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,825 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,831 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,832 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,837 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,840 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,846 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,849 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,854 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,856 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,861 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,863 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,867 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,869 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,873 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,874 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,878 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,879 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,884 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,886 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,895 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,899 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,905 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,908 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,912 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,913 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,917 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,918 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,919 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,921 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:23,923 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,925 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,926 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,927 [root] DEBUG: Loader: Injecting process 45496 (thread 45500) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:23,928 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,930 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:23,931 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,934 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:23,936 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,937 [lib.api.process] INFO: Injected into 64-bit <Process 45496 WmiPrvSE.exe>
2026-05-28 21:14:23,938 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,942 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 45496
2026-05-28 21:14:23,943 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,945 [lib.api.process] INFO: Monitor config for process 45496: C:\lpw_albt\dll\45496.ini
2026-05-28 21:14:23,946 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,947 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:23,950 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,952 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,957 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,961 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,965 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,969 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,977 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,980 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,986 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,987 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,993 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:23,994 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:23,999 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,002 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,006 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,008 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,013 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,016 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,021 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,023 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,029 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,030 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,038 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,039 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,044 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,045 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,050 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,051 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,061 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,063 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,069 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,069 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,074 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,076 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,081 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,083 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,088 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,090 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,095 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,097 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,101 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,104 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,113 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,114 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,120 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,124 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,130 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,131 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,137 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,138 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,143 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,144 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,149 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,151 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,157 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,160 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,165 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,166 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,171 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,173 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,179 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,181 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,186 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,187 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,189 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,191 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,193 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,195 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,195 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,198 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,201 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,206 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,214 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,216 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,220 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,222 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,226 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,228 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,234 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,236 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,242 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,244 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,249 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,253 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,259 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,261 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,266 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,267 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,272 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,273 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,278 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,281 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,286 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,287 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,291 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,292 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,298 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,300 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,308 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,309 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,315 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,317 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,323 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,325 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,330 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,334 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,339 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,341 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,347 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,349 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,358 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,363 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,369 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,374 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,379 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,381 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,386 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,387 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,391 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,393 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,399 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,400 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,405 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,407 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,412 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,413 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,418 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,420 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,424 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,429 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,434 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,435 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,440 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,441 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,446 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,447 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,453 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,454 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,461 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,463 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,469 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,471 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,477 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,478 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,483 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,484 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,490 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,492 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,497 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,499 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,504 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,507 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,512 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,514 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,519 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,521 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,525 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,526 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,530 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,532 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,540 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,542 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,547 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,549 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,554 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,556 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,561 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,562 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,566 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,568 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,573 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,574 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,580 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,582 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,587 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,589 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,594 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,596 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,602 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,603 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,609 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,613 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,618 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,619 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,624 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,628 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,634 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-28 21:14:24,635 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,636 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,641 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,642 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,646 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:24,646 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,650 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,653 [root] DEBUG: Loader: Injecting process 43116 with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:24,654 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 43120, handle 0x120
2026-05-28 21:14:24,655 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,656 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:24,659 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:24,661 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,661 [lib.api.process] INFO: Injected into 64-bit <Process 43116 elevation_service.exe>
2026-05-28 21:14:24,667 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,668 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,674 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,676 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,678 [root] DEBUG: 43116: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:24,680 [root] DEBUG: 43116: Interactive desktop enabled.
2026-05-28 21:14:24,681 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,683 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,684 [root] DEBUG: 43116: Dropped file limit defaulting to 100.
2026-05-28 21:14:24,688 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,690 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,692 [root] DEBUG: 43116: Disabling sleep skipping.
2026-05-28 21:14:24,695 [root] DEBUG: 43116: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:24,697 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,701 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,707 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,709 [root] DEBUG: 43116: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:14:24,710 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,710 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,715 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,716 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,720 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,721 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,726 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,728 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,733 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,733 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,737 [root] DEBUG: 43116: Monitor initialised: 64-bit capemon loaded in process 43116 at 0x00007FFF18240000, thread 43120, image base 0x00007FF717E20000, stack from 0x000000031ECF4000-0x000000031ED00000
2026-05-28 21:14:24,737 [root] DEBUG: 43116: Commandline: "C:\Program Files\Google\Chrome\Application\148.0.7778.217\elevation_service.exe"
2026-05-28 21:14:24,739 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,742 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,747 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,748 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,753 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,754 [root] DEBUG: 43116: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-28 21:14:24,756 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,760 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,762 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,770 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,771 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,776 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,777 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 21:14:24,779 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,779 [root] DEBUG: 43116: set_hooks: Unable to hook LockResource
2026-05-28 21:14:24,784 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,784 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,785 [root] DEBUG: 43116: Hooked 627 out of 628 functions
2026-05-28 21:14:24,789 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,791 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,797 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,799 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,807 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,810 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,813 [root] DEBUG: 43116: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:24,818 [root] DEBUG: 43116: RestoreHeaders: Restored original import table.
2026-05-28 21:14:24,819 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,821 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,823 [root] INFO: Loaded monitor into process with pid 43116
2026-05-28 21:14:24,825 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,827 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,828 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,832 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,833 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,841 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,843 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,849 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,852 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,856 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,857 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,858 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,863 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,866 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,870 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,871 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,876 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,877 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,878 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,882 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,884 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,889 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,889 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,895 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,898 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,901 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,903 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,904 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,909 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,910 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,916 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,919 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,923 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,924 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,925 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,930 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,932 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,937 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,938 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,942 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,944 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,945 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,948 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,951 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,956 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,958 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,963 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,967 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,971 [root] DEBUG: 43116: caller_dispatch: Scanning calling region at 0x00007FF717E20000...
2026-05-28 21:14:24,971 [root] DEBUG: 43116: caller_dispatch: Added region at 0x00007FF717E20000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF717FDDF76, thread 43120).
2026-05-28 21:14:24,973 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,973 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,975 [root] DEBUG: 43116: YaraScan: Scanning 0x00007FF717E20000, size 0x3cffe0
2026-05-28 21:14:24,976 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,981 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,982 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,989 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,991 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:24,998 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:24,999 [root] DEBUG: 43116: ProcessImageBase: Main module image at 0x00007FF717E20000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:25,000 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,001 [root] DEBUG: 43116: ProcessImageBase: Main module image at 0x00007FF717E20000 unmodified (entropy change 1.659153e-04)
2026-05-28 21:14:25,002 [root] DEBUG: 43116: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-28 21:14:25,004 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,007 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,007 [root] DEBUG: 43116: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 21:14:25,012 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,014 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,015 [root] DEBUG: 43116: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:14:25,018 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,020 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,025 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,026 [root] DEBUG: 43116: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:14:25,028 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,032 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,034 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,039 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,041 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,043 [root] DEBUG: 43116: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 21:14:25,046 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,047 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,050 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,052 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,052 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,053 [root] DEBUG: 39860: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-28 21:14:25,055 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,059 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,059 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,061 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,062 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,067 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,067 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,069 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,070 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,076 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,077 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,081 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,084 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,089 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,090 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,094 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,095 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,100 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,102 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,105 [root] DEBUG: 43116: DLL loaded at 0x00007FFF57350000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-28 21:14:25,107 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,109 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,111 [root] DEBUG: 43116: DLL loaded at 0x00007FFF57560000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-28 21:14:25,112 [root] DEBUG: 43116: DLL loaded at 0x00007FFF45050000: C:\Windows\system32\ncryptprov (0x5a000 bytes).
2026-05-28 21:14:25,114 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,117 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,124 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,124 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,126 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,127 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,125 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,129 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,131 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,132 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,133 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,135 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,137 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,139 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,143 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,144 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,149 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,150 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,153 [root] DEBUG: 39860: DLL loaded at 0x00007FFF3E560000: C:\Windows\System32\CapabilityAccessManagerClient (0x3f000 bytes).
2026-05-28 21:14:25,155 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,157 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,157 [root] DEBUG: 43116: NtTerminateProcess hook: Attempting to dump process 43116
2026-05-28 21:14:25,162 [root] DEBUG: 43116: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:14:25,162 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,164 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,168 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,170 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,172 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,173 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4F6E0000: C:\Windows\System32\usermgrproxy (0x54000 bytes).
2026-05-28 21:14:25,175 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,176 [root] DEBUG: 43116: caller_dispatch: Added region at 0x00007FFF56FD0000 to tracked regions list (ntdll::NtClose returns to 0x00007FFF56FD419B, thread 43120).
2026-05-28 21:14:25,178 [root] DEBUG: 43116: caller_dispatch: Scanning calling region at 0x00007FFF56FD0000...
2026-05-28 21:14:25,180 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,184 [root] INFO: Process with pid 43116 has terminated
2026-05-28 21:14:25,184 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,191 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,193 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266434e+00 (from 6.266012e+00)
2026-05-28 21:14:25,195 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,199 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,200 [root] DEBUG: 39860: DLL loaded at 0x00007FFF457F0000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-28 21:14:25,204 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,205 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,206 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:25,207 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,208 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,210 [root] DEBUG: 39860: DLL loaded at 0x00007FFF42E10000: C:\Windows\system32\explorerframe (0x244000 bytes).
2026-05-28 21:14:25,213 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,214 [root] DEBUG: Loader: Injecting process 45496 (thread 45500) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:25,215 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,216 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,219 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,219 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:25,221 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,222 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:25,224 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,224 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,224 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,225 [lib.api.process] INFO: Injected into 64-bit <Process 45496 WmiPrvSE.exe>
2026-05-28 21:14:25,229 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,231 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,230 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,229 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,232 [root] DEBUG: 39860: DLL loaded at 0x00007FFF48B40000: C:\Windows\System32\WININET (0x4d6000 bytes).
2026-05-28 21:14:25,235 [root] DEBUG: 39860: DLL loaded at 0x00007FFF3D6A0000: C:\Windows\System32\windows.internal.shell.broker (0xdd000 bytes).
2026-05-28 21:14:25,236 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,237 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,240 [root] DEBUG: 45496: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:25,242 [root] DEBUG: 45496: Interactive desktop enabled.
2026-05-28 21:14:25,243 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,243 [root] DEBUG: 45496: Dropped file limit defaulting to 100.
2026-05-28 21:14:25,244 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,246 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,247 [root] DEBUG: 45496: Disabling sleep skipping.
2026-05-28 21:14:25,248 [root] DEBUG: 39860: DLL loaded at 0x00007FFF48780000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-28 21:14:25,249 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,250 [root] DEBUG: 45496: Services hook set enabled
2026-05-28 21:14:25,255 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,257 [root] DEBUG: 45496: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:25,260 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,261 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,262 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,264 [root] DEBUG: 39860: DLL loaded at 0x00007FFF43060000: C:\Windows\System32\PCShellCommonProxyStub (0x13000 bytes).
2026-05-28 21:14:25,265 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,267 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,275 [root] DEBUG: 45496: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:14:25,276 [root] DEBUG: 45496: Monitor initialised: 64-bit capemon loaded in process 45496 at 0x00007FFF18240000, thread 45500, image base 0x00007FF7BB740000, stack from 0x0000003FF7F20000-0x0000003FF7F30000
2026-05-28 21:14:25,277 [root] DEBUG: 45496: Commandline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
2026-05-28 21:14:25,285 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,287 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,292 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,294 [root] DEBUG: 45496: Hooked 69 out of 69 functions
2026-05-28 21:14:25,295 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,298 [root] DEBUG: 45496: RestoreHeaders: Restored original import table.
2026-05-28 21:14:25,299 [root] INFO: Loaded monitor into process with pid 45496
2026-05-28 21:14:25,303 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,306 [root] DEBUG: 45496: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:14:25,306 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,307 [root] DEBUG: 45496: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 21:14:25,311 [root] DEBUG: 45496: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:14:25,314 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,317 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,318 [root] DEBUG: 45496: DLL loaded at 0x00007FFF3FD20000: C:\Windows\system32\wbem\wbemprox (0x11000 bytes).
2026-05-28 21:14:25,327 [root] DEBUG: 45496: DLL loaded at 0x00007FFF3F950000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2026-05-28 21:14:25,328 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,331 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,336 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,338 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,341 [root] DEBUG: 45496: DLL loaded at 0x00007FFF4D000000: C:\Windows\system32\wbem\wmiutils (0x28000 bytes).
2026-05-28 21:14:25,345 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,349 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,356 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,358 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,363 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,364 [root] DEBUG: 45496: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-28 21:14:25,364 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,368 [root] DEBUG: 45496: DLL loaded at 0x00007FFF13200000: C:\Windows\SYSTEM32\framedynos (0x52000 bytes).
2026-05-28 21:14:25,369 [root] DEBUG: 45496: DLL loaded at 0x00007FFF12FD0000: C:\Windows\system32\wbem\cimwin32 (0x20c000 bytes).
2026-05-28 21:14:25,370 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,371 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,377 [root] DEBUG: 45496: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-28 21:14:25,378 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,379 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,385 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,391 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,394 [root] DEBUG: 45496: DLL loaded at 0x000001F5531E0000: C:\Windows\SYSTEM32\WMI (0x3000 bytes).
2026-05-28 21:14:25,397 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,400 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,400 [root] DEBUG: 45496: DLL loaded at 0x00007FFF520C0000: C:\Windows\SYSTEM32\wmiclnt (0x11000 bytes).
2026-05-28 21:14:25,405 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,407 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,408 [root] DEBUG: 45496: CreateThreadBreakpoints: Failed to open thread and get a handle.
2026-05-28 21:14:25,409 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,412 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,416 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,417 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,419 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,421 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,422 [root] DEBUG: 45496: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\wtsapi32 (0x14000 bytes).
2026-05-28 21:14:25,424 [root] DEBUG: 45496: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-28 21:14:25,424 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,425 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,427 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,429 [root] DEBUG: 45496: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-28 21:14:25,430 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,432 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,433 [root] DEBUG: 45496: DLL loaded at 0x00007FFF572F0000: C:\Windows\SYSTEM32\DEVOBJ (0x33000 bytes).
2026-05-28 21:14:25,434 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,435 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,437 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,440 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,441 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,445 [root] DEBUG: 45496: DLL loaded at 0x00007FFF43550000: C:\Windows\SYSTEM32\NETAPI32 (0x19000 bytes).
2026-05-28 21:14:25,446 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,447 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,449 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,450 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,451 [root] DEBUG: 45496: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\SYSTEM32\SAMCLI (0x19000 bytes).
2026-05-28 21:14:25,453 [root] DEBUG: 45496: DLL loaded at 0x00007FFF4D670000: C:\Windows\SYSTEM32\SRVCLI (0x28000 bytes).
2026-05-28 21:14:25,455 [root] DEBUG: 45496: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\NETUTILS (0xc000 bytes).
2026-05-28 21:14:25,457 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,459 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,461 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,462 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,465 [root] DEBUG: 45496: DLL loaded at 0x00007FFF56B10000: C:\Windows\SYSTEM32\LOGONCLI (0x43000 bytes).
2026-05-28 21:14:25,467 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,470 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,470 [root] DEBUG: 45496: DLL loaded at 0x00007FFF4F210000: C:\Windows\SYSTEM32\SCHEDCLI (0xc000 bytes).
2026-05-28 21:14:25,472 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,475 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,476 [root] DEBUG: 45496: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\WKSCLI (0x19000 bytes).
2026-05-28 21:14:25,480 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,480 [root] DEBUG: 45496: DLL loaded at 0x00007FFF52850000: C:\Windows\SYSTEM32\DSROLE (0xa000 bytes).
2026-05-28 21:14:25,482 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,490 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,492 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,492 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,493 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,495 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,496 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,500 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,501 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,502 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,502 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,507 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,510 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,516 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,519 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,521 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,522 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,527 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,528 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,533 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,533 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,535 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,539 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,539 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,543 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,546 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,547 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,549 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,550 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,552 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,554 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,554 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,556 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,559 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,560 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,565 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,568 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,572 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,573 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,578 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,580 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,585 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,588 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,593 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,596 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,602 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,605 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,611 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,613 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,619 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,621 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,626 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,627 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,631 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,634 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,641 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,642 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,647 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,648 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,653 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,654 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,659 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,660 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,665 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,666 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,670 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,672 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,677 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,678 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,683 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,684 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,689 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,690 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,696 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,697 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,703 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,705 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,709 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,711 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,716 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,718 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,719 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,723 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,724 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,726 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,730 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,731 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,733 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,733 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,738 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,739 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,740 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,740 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,746 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,748 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,753 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,755 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,757 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,758 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,764 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,765 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,771 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,773 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,779 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,780 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,785 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,787 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,792 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,794 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,799 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,800 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,805 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,807 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,812 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,813 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,818 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,820 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,825 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,827 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,833 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,840 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,845 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,848 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,853 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,854 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,859 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,860 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,865 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,868 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,873 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,874 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,878 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,881 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,888 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,889 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,894 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,896 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,904 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,905 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,912 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,913 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,918 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,920 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,925 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,926 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,931 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,932 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,937 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,937 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,942 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,944 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,948 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,949 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,953 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,956 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,961 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,963 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,968 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,969 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,973 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,975 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,980 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,981 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:25,988 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:25,993 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,000 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,003 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,008 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,010 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,014 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,016 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,022 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,024 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,029 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,030 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,034 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,035 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,040 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,042 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,047 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,048 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,053 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,056 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,061 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,063 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,071 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,072 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,077 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,078 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,085 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,087 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,091 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,093 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,098 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,100 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,104 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,106 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,111 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,174 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,236 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,302 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,304 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,371 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,375 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,437 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,500 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,502 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,568 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,570 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,571 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,634 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,636 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,699 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,777 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,779 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,844 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,846 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,909 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,912 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:26,995 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:26,998 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,087 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,088 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,156 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,159 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,224 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,226 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,292 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,295 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,360 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,363 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,429 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,432 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,574 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,642 [root] DEBUG: 4484: api-cap: NtReleaseMutant hook disabled due to count: 5000
2026-05-28 21:14:27,645 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 51244: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6706B0000
2026-05-28 21:14:27,650 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,712 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,714 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 51244
2026-05-28 21:14:27,716 [lib.api.process] INFO: Monitor config for process 51244: C:\lpw_albt\dll\51244.ini
2026-05-28 21:14:27,718 [root] DEBUG: 4484: api-cap: NtOpenProcess hook disabled due to count: 5000
2026-05-28 21:14:27,720 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:27,721 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,725 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:27,732 [root] DEBUG: 4484: api-cap: NtOpenProcess hook disabled due to count: 5001
2026-05-28 21:14:27,734 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,736 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,743 [root] DEBUG: Loader: Injecting process 51244 (thread 51248) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:27,745 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,747 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,756 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,758 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:27,764 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,774 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,785 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,785 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:27,791 [lib.api.process] INFO: Injected into 64-bit <Process 51244 dllhost.exe>
2026-05-28 21:14:27,794 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,796 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,797 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 51244
2026-05-28 21:14:27,798 [lib.api.process] INFO: Monitor config for process 51244: C:\lpw_albt\dll\51244.ini
2026-05-28 21:14:27,799 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:27,805 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,805 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\TQDMPSoj.dll, loader C:\lpw_albt\bin\AqpBuwuB.exe
2026-05-28 21:14:27,808 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,812 [root] DEBUG: Loader: Injecting process 51244 (thread 51248) with C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:27,813 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:27,815 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,818 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\TQDMPSoj.dll.
2026-05-28 21:14:27,819 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,822 [lib.api.process] INFO: Injected into 64-bit <Process 51244 dllhost.exe>
2026-05-28 21:14:27,827 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,832 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,832 [root] DEBUG: 51244: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:27,835 [root] DEBUG: 51244: Interactive desktop enabled.
2026-05-28 21:14:27,839 [root] DEBUG: 51244: Dropped file limit defaulting to 100.
2026-05-28 21:14:27,842 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,843 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,845 [root] DEBUG: 51244: Disabling sleep skipping.
2026-05-28 21:14:27,848 [root] DEBUG: 51244: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:27,852 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,854 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,859 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,865 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,870 [root] DEBUG: 51244: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-28 21:14:27,872 [root] DEBUG: 51244: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026
2026-05-28 21:14:27,873 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,886 [root] DEBUG: 51244: Monitor initialised: 64-bit capemon loaded in process 51244 at 0x00007FFF18240000, thread 51248, image base 0x00007FF6706B0000, stack from 0x0000003DE21C4000-0x0000003DE21D0000
2026-05-28 21:14:27,888 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,910 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,917 [root] DEBUG: 51244: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-28 21:14:27,918 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,926 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,933 [root] DEBUG: 51244: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-28 21:14:27,934 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,946 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,949 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,957 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,958 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-28 21:14:27,960 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,963 [root] DEBUG: 51244: set_hooks: Unable to hook LockResource
2026-05-28 21:14:27,971 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,972 [root] DEBUG: 51244: Hooked 627 out of 628 functions
2026-05-28 21:14:27,976 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,977 [root] DEBUG: 51244: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:27,982 [root] DEBUG: 51244: RestoreHeaders: Restored original import table.
2026-05-28 21:14:27,983 [root] INFO: Loaded monitor into process with pid 51244
2026-05-28 21:14:27,985 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,987 [root] DEBUG: 51244: caller_dispatch: Added region at 0x00007FF6706B0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6706B12F2, thread 51248).
2026-05-28 21:14:27,988 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:27,992 [root] DEBUG: 51244: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026
2026-05-28 21:14:27,994 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:27,998 [root] DEBUG: 51244: ProcessImageBase: Main module image at 0x00007FF6706B0000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:27,998 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,001 [root] DEBUG: 51244: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-28 21:14:28,004 [root] DEBUG: 51244: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-28 21:14:28,004 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,008 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,008 [root] DEBUG: 51244: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-28 21:14:28,013 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,015 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,020 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,022 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,027 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,029 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,031 [root] DEBUG: 51244: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-28 21:14:28,035 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,039 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,048 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,051 [root] DEBUG: 51244: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-28 21:14:28,053 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,054 [root] DEBUG: 51244: DLL loaded at 0x00007FFF432B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-28 21:14:28,059 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,061 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,063 [root] DEBUG: 51244: DLL loaded at 0x00007FFF52860000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-28 21:14:28,065 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,067 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,073 [root] DEBUG: 4484: api-cap: NtCreateMutant hook disabled due to count: 5000
2026-05-28 21:14:28,074 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,075 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,080 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,081 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,088 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,090 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,095 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,097 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,103 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,104 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,109 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,110 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,116 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,117 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,121 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,122 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,128 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,134 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,140 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,143 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,149 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,151 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,156 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,161 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,168 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,169 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,179 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,181 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,186 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,188 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,194 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,195 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,200 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,201 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,207 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,211 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,215 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,218 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,226 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,227 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,234 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,237 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,242 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,245 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,254 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,256 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,260 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,265 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,269 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,271 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,276 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,277 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,286 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,288 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,294 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,295 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,300 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,301 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,306 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,308 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,312 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,319 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,324 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,326 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,332 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,333 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,339 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,342 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,349 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,353 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,358 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,359 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,365 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,366 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,371 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,375 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,383 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,384 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,388 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,392 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,397 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,399 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,404 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,407 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,411 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,414 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,419 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,420 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,425 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,426 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,432 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,434 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,439 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,441 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,447 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,447 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,451 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,452 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,460 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,462 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,468 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,471 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,480 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,482 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,489 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,492 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,497 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,500 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,505 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,508 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,517 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,520 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,526 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,528 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,532 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,534 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,540 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,541 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,546 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,547 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,552 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,554 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,560 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,561 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,565 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,566 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,572 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,572 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,577 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,578 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,583 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,585 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,591 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,593 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,597 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,599 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,604 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,606 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,612 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,613 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,618 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,619 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,624 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,625 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,630 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,632 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,638 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,639 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,644 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,645 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,649 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,650 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,655 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,656 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,661 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,662 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,666 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,667 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,672 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,673 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,678 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,681 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,685 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,686 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,690 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,692 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,696 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,697 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,702 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,703 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,707 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,710 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,718 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,720 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,725 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,727 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,733 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,736 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,744 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,748 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,756 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,757 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,762 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,763 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,767 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,768 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,775 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,776 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,784 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,786 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,793 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,794 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,801 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,806 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,812 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,818 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,823 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,827 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,836 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,838 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,845 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,848 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,853 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,855 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,859 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,861 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,866 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,868 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,876 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,879 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,883 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,884 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,889 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,890 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,896 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,900 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,908 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,910 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,916 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,918 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,924 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,926 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,930 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,931 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,936 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,937 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,942 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,944 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,948 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,950 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,954 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,956 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,961 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,962 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,968 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,969 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,975 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,975 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,980 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,980 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,985 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,986 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,991 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,993 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:28,997 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:28,999 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,004 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,008 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,013 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,014 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,019 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,020 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,025 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,026 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,031 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,036 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,041 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,044 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,048 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,049 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,054 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,057 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,064 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,066 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,071 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,072 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,076 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,078 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,084 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,086 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,091 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,097 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,103 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,105 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,109 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,110 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,115 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,117 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,126 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,128 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,133 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,134 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,139 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,139 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,144 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,145 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,149 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,156 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,161 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,163 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,170 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,172 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,178 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,184 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,189 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,190 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,195 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,197 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,201 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,202 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,207 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,210 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,214 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,216 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,221 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,223 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,229 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,230 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,235 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,236 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,241 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,242 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,247 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,249 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,256 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,257 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,262 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,265 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,270 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,274 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,279 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,280 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,284 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,287 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,292 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,292 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,297 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,298 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,303 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,305 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,309 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,310 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,315 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,317 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,325 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,327 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,331 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,332 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,339 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,341 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,346 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,348 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,355 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,356 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,361 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,362 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,366 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,368 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,372 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,373 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,378 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,380 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,390 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,391 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,399 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,401 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,407 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,412 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,418 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,420 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,425 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,428 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,434 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,438 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,446 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,447 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,455 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,456 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,461 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,463 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,468 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,470 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,477 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,479 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,485 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,487 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,494 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,496 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,500 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,502 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,509 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,511 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,522 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,524 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,529 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,531 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,538 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,541 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,546 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,547 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,552 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,555 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,560 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,562 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,567 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,569 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,574 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,574 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,579 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,580 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,587 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,589 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,594 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,596 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,601 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,602 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,609 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,610 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,613 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,614 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,615 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,616 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,621 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,622 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,627 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,630 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,635 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,637 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,641 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,642 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,647 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,649 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,654 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,655 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,660 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,661 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,666 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,667 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,672 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,673 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,678 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,680 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,684 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,686 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,690 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,692 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,697 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,699 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,703 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,706 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,710 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,712 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,716 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,717 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,722 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,723 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,729 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,731 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,735 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,736 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,741 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,742 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,748 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,750 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,757 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,760 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,765 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,766 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,773 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,774 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,778 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,779 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,784 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,785 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,792 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,793 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,798 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,800 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,804 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,807 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,811 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,813 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,820 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,823 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,828 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,829 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,834 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,836 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,840 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,843 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,847 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,850 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,855 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,858 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,863 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,864 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,871 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,872 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,877 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,878 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,883 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,885 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,890 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,890 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,895 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,897 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,902 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,904 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,910 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,911 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,917 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,920 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,924 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,926 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,934 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,935 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,944 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,945 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,954 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,956 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,962 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,965 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,972 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,974 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,979 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,980 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,985 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,986 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,991 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:29,992 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:29,996 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,001 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,007 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,008 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,014 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,016 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,022 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,023 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,028 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,029 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,038 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,039 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,044 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,045 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,050 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,051 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,057 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,058 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,064 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,066 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,070 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,071 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,079 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,081 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,086 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,087 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,091 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,093 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,101 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,102 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,106 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,107 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,113 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,116 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,121 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,123 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,127 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,129 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,134 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,135 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,139 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,141 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,145 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,147 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,152 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,153 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,158 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,160 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,165 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,166 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,171 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,173 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,178 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,180 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,184 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,186 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,191 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,193 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,198 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,198 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,203 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,204 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,209 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,212 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,217 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,218 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,225 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,228 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,235 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,238 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,242 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,244 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,248 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,249 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,256 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,258 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,263 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,264 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,269 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,270 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,275 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,277 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,285 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,288 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,293 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,296 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,301 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,303 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,310 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,312 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,319 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,321 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,328 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,332 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,337 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,341 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,349 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,351 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,356 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,358 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,367 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,370 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,374 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,377 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,381 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,382 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,387 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,389 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,395 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,400 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,405 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,406 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,413 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,415 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,420 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,421 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,426 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,427 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,431 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,432 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,438 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,439 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,443 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,445 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,449 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,451 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,455 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,456 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,461 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,464 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,469 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,471 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,475 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,476 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,481 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,483 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,488 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,489 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,495 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,500 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,506 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,508 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,513 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,514 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,518 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,519 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,524 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,526 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,531 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,533 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,538 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,539 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,543 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,544 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,549 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,550 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,556 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,557 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,561 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,564 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,568 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,571 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,575 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,576 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,580 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,583 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,590 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,591 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,596 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,598 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,603 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,604 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,608 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,611 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,616 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,618 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,622 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,624 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,629 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,632 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,637 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,639 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,643 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,645 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,651 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,653 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,658 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,661 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,665 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,666 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,671 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,673 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,677 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,680 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,685 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,686 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,692 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,694 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,699 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,700 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,704 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,707 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,712 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,713 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,719 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,721 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,725 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,725 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,732 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,734 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,738 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,740 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,745 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,747 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,752 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,753 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,759 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,761 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,765 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,766 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,772 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,774 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,779 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,781 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,786 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,789 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,797 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,800 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,807 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,809 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,814 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,815 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,821 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,823 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,827 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,828 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,833 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,836 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,841 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,842 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,847 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,849 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,854 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,855 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,861 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,862 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,867 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,868 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,873 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,874 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,878 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,880 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,885 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,886 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,890 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,891 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,896 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,898 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,903 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,905 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,910 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,911 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,916 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,917 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,922 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,923 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,930 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,931 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,936 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,937 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,944 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,945 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,951 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,951 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,958 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,960 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,966 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,968 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,973 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,974 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,979 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,980 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,989 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,991 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:30,996 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:30,998 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,002 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,004 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,010 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,010 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,015 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,016 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,023 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,025 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,029 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,031 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,038 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,039 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,044 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,046 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,050 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,052 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,058 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,060 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,064 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,066 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,072 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,073 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,078 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,079 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,087 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,088 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,093 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,094 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,100 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,102 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,106 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,108 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,113 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,114 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,119 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,121 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,126 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,127 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,133 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,133 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,138 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,139 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,143 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,146 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,152 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,153 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,158 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,160 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,164 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,166 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,170 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,171 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,176 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,179 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,184 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,186 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,192 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,193 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,198 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,200 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,204 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,206 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,211 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,212 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,217 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,218 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,223 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,225 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,230 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,231 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,240 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,246 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,254 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,256 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,261 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,262 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,267 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,271 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,277 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,278 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,282 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,284 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,289 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,290 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,296 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,297 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,302 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,304 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,309 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,311 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,315 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,316 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,321 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,323 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,327 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,328 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,333 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,335 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,340 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,341 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,347 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,348 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,355 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,356 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,360 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,362 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,369 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,371 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,375 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,377 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,385 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,386 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,391 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,392 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,397 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,399 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,404 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,408 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,413 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,413 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,418 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,420 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,426 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,428 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,435 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,437 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,442 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,446 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,450 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,453 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,465 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,466 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,472 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,474 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,479 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,479 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,484 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,485 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,490 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:31,493 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:31,494 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4D250000: C:\Windows\System32\perfos (0xf000 bytes).
2026-05-28 21:14:33,209 [root] INFO: Process with pid 51244 has terminated
2026-05-28 21:14:33,211 [root] DEBUG: 51244: NtTerminateProcess hook: Attempting to dump process 51244
2026-05-28 21:14:33,212 [root] DEBUG: 51244: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:14:37,838 [root] INFO: Announced starting service "b'GoogleUpdaterService149.0.7814.0'"
2026-05-28 21:14:38,850 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 55848: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x0000000000850000
2026-05-28 21:14:38,852 [root] INFO: Announced 32-bit process name: updater.exe pid: 55848
2026-05-28 21:14:38,854 [lib.api.process] INFO: Monitor config for process 55848: C:\lpw_albt\dll\55848.ini
2026-05-28 21:14:38,856 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:38,865 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:38,871 [root] DEBUG: Loader: Injecting process 55848 (thread 55852) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:38,872 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:38,873 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:38,875 [lib.api.process] INFO: Injected into 32-bit <Process 55848 updater.exe>
2026-05-28 21:14:38,876 [root] INFO: Announced 32-bit process name: updater.exe pid: 55848
2026-05-28 21:14:38,877 [lib.api.process] INFO: Monitor config for process 55848: C:\lpw_albt\dll\55848.ini
2026-05-28 21:14:38,878 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:38,885 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:38,890 [root] DEBUG: Loader: Injecting process 55848 (thread 55852) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:38,892 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:38,893 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:38,895 [lib.api.process] INFO: Injected into 32-bit <Process 55848 updater.exe>
2026-05-28 21:14:38,897 [root] INFO: Announced 32-bit process name: updater.exe pid: 55848
2026-05-28 21:14:38,899 [lib.api.process] INFO: Monitor config for process 55848: C:\lpw_albt\dll\55848.ini
2026-05-28 21:14:38,900 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:38,910 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:38,916 [root] DEBUG: Loader: Injecting process 55848 with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:38,918 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2026-05-28 21:14:38,927 [root] DEBUG: 55848: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:38,928 [root] DEBUG: 55848: Interactive desktop enabled.
2026-05-28 21:14:38,929 [root] DEBUG: 55848: Dropped file limit defaulting to 100.
2026-05-28 21:14:38,935 [root] DEBUG: 55848: Disabling sleep skipping.
2026-05-28 21:14:38,936 [root] DEBUG: 55848: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:38,938 [root] DEBUG: 55848: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:38,976 [root] DEBUG: 55848: Monitor initialised: 32-bit capemon loaded in process 55848 at 0x6ae20000, thread 55968, image base 0x850000, stack from 0x7f5000-0x800000
2026-05-28 21:14:38,983 [root] DEBUG: 55848: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update
2026-05-28 21:14:39,010 [root] DEBUG: 55848: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:39,029 [root] DEBUG: 55848: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:39,031 [root] DEBUG: 55848: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:39,036 [root] DEBUG: 55848: Hooked 632 out of 632 functions
2026-05-28 21:14:39,078 [root] DEBUG: 55848: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:39,082 [root] DEBUG: 55848: RestoreHeaders: Restored original import table.
2026-05-28 21:14:39,086 [root] INFO: Loaded monitor into process with pid 55848
2026-05-28 21:14:39,092 [root] DEBUG: 55848: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 55968).
2026-05-28 21:14:39,093 [root] DEBUG: 55848: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:39,095 [root] DEBUG: 55848: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,134 [root] DEBUG: 55848: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,174 [root] DEBUG: 55848: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,213 [root] DEBUG: 55848: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,253 [root] DEBUG: 55848: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,291 [root] DEBUG: 55848: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,331 [root] DEBUG: 55848: caller_dispatch: Added region at 0x003A0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x003A0037, thread 55968).
2026-05-28 21:14:39,334 [root] DEBUG: 55848: DumpPEsInRange: Scanning range 0x003A0000 - 0x003A0129.
2026-05-28 21:14:39,336 [root] DEBUG: 55848: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::LdrLoadDll returns to 0x00A551D4, thread 56016).
2026-05-28 21:14:39,339 [root] DEBUG: 55848: ScanForDisguisedPE: Size too small: 0x129 bytes
2026-05-28 21:14:39,340 [root] DEBUG: 55848: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:39,344 [lib.common.results] INFO: Uploading file C:\EsskdWmsyS\CAPE\55848_18953883914129552026 to CAPE\c4d16ca83e62817de339269c3fe57260faece455aca6e2d22d4197047149e23f; Size is 297; Max size: 100000000
2026-05-28 21:14:39,344 [root] DEBUG: 55848: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,352 [root] DEBUG: 55848: DumpMemory: Payload successfully created: C:\EsskdWmsyS\CAPE\55848_18953883914129552026 (size 297 bytes)
2026-05-28 21:14:39,354 [root] DEBUG: 55848: DumpRegion: Dumped entire allocation from 0x003A0000, size 4096 bytes.
2026-05-28 21:14:39,355 [root] DEBUG: 55848: ProcessTrackedRegion: Dumped region at 0x003A0000.
2026-05-28 21:14:39,356 [root] DEBUG: 55848: YaraScan: Scanning 0x003A0000, size 0x129
2026-05-28 21:14:39,389 [root] DEBUG: 55848: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:39,391 [root] DEBUG: 55848: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:39,397 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 21:14:39,398 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:39,400 [lib.api.process] INFO: Injected into 32-bit <Process 55848 updater.exe>
2026-05-28 21:14:39,405 [root] DEBUG: 55848: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:39,407 [root] DEBUG: 55848: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:39,412 [root] DEBUG: 55848: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:39,413 [root] DEBUG: 55848: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:39,418 [root] DEBUG: 55848: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:39,429 [root] DEBUG: 55848: CreateProcessHandler: Injection info set for new process 56176: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x00850000
2026-05-28 21:14:39,431 [root] INFO: Announced 32-bit process name: updater.exe pid: 56176
2026-05-28 21:14:39,432 [lib.api.process] INFO: Monitor config for process 56176: C:\lpw_albt\dll\56176.ini
2026-05-28 21:14:39,434 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:39,441 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:39,449 [root] DEBUG: Loader: Injecting process 56176 (thread 56180) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:39,451 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:39,452 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:39,455 [lib.api.process] INFO: Injected into 32-bit <Process 56176 updater.exe>
2026-05-28 21:14:39,458 [root] DEBUG: 55848: DLL loaded at 0x74960000: C:\Windows\system32\apphelp (0x9f000 bytes).
2026-05-28 21:14:39,467 [root] DEBUG: 56176: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:39,471 [root] DEBUG: 56176: Interactive desktop enabled.
2026-05-28 21:14:39,472 [root] DEBUG: 56176: Dropped file limit defaulting to 100.
2026-05-28 21:14:39,479 [root] DEBUG: 56176: Disabling sleep skipping.
2026-05-28 21:14:39,481 [root] DEBUG: 56176: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:39,484 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,524 [root] DEBUG: 56176: Monitor initialised: 32-bit capemon loaded in process 56176 at 0x6ae20000, thread 56180, image base 0x850000, stack from 0x52f4000-0x5300000
2026-05-28 21:14:39,526 [root] DEBUG: 56176: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2d8,0x2dc,0x2e0,0x2d4,0x2e4,0xe08584,0xe08
2026-05-28 21:14:39,552 [root] DEBUG: 56176: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:39,566 [root] DEBUG: 56176: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:39,568 [root] DEBUG: 56176: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:39,575 [root] DEBUG: 56176: Hooked 632 out of 632 functions
2026-05-28 21:14:39,616 [root] DEBUG: 56176: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:39,620 [root] DEBUG: 56176: RestoreHeaders: Restored original import table.
2026-05-28 21:14:39,621 [root] INFO: Loaded monitor into process with pid 56176
2026-05-28 21:14:39,627 [root] DEBUG: 56176: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 56180).
2026-05-28 21:14:39,627 [root] DEBUG: 56176: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:39,629 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,670 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,711 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,755 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,797 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,836 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,876 [root] DEBUG: 56176: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:39,877 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,882 [root] DEBUG: 56176: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00B218AC, thread 56180).
2026-05-28 21:14:39,885 [root] DEBUG: 56176: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:39,919 [root] DEBUG: 56176: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:39,920 [root] DEBUG: 56176: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:39,927 [root] DEBUG: 56176: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 3.815347e-06)
2026-05-28 21:14:39,931 [root] DEBUG: 56176: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:39,934 [root] DEBUG: 56176: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:39,938 [root] DEBUG: 56176: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:39,939 [root] DEBUG: 56176: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:39,944 [root] DEBUG: 56176: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:39,949 [root] DEBUG: 56176: OpenProcessHandler: Image base for process 55848 (handle 0x2e8): 0x00850000.
2026-05-28 21:14:39,952 [root] DEBUG: 56176: OpenProcessHandler: Injection info created for process 55848, handle 0x2e8: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
2026-05-28 21:14:39,973 [root] DEBUG: 55848: DLL loaded at 0x74950000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-28 21:14:39,977 [root] DEBUG: 55848: DLL loaded at 0x76650000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-05-28 21:14:39,986 [root] DEBUG: 55848: OpenProcessHandler: Injection info created for process 4484, handle 0x378: C:\Windows\explorer.exe
2026-05-28 21:14:40,052 [root] DEBUG: 55848: DLL loaded at 0x748A0000: C:\Windows\SYSTEM32\wkscli (0x11000 bytes).
2026-05-28 21:14:40,056 [root] DEBUG: 55848: DLL loaded at 0x74890000: C:\Windows\SYSTEM32\netutils (0xb000 bytes).
2026-05-28 21:14:40,058 [root] DEBUG: 55848: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-28 21:14:40,059 [root] DEBUG: 55848: DLL loaded at 0x6ADC0000: C:\Windows\SYSTEM32\MDMRegistration (0x53000 bytes).
2026-05-28 21:14:40,067 [root] DEBUG: 55848: DLL loaded at 0x6F2A0000: C:\Windows\SYSTEM32\powrprof (0x44000 bytes).
2026-05-28 21:14:40,071 [root] DEBUG: 55848: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2026-05-28 21:14:40,072 [root] DEBUG: 55848: DLL loaded at 0x70D00000: C:\Windows\SYSTEM32\ncrypt (0x21000 bytes).
2026-05-28 21:14:40,076 [root] DEBUG: 55848: DLL loaded at 0x76790000: C:\Windows\System32\imagehlp (0x19000 bytes).
2026-05-28 21:14:40,077 [root] DEBUG: 55848: DLL loaded at 0x6AD00000: C:\Windows\SYSTEM32\tbs (0x13000 bytes).
2026-05-28 21:14:40,079 [root] DEBUG: 55848: DLL loaded at 0x6AD20000: C:\Windows\SYSTEM32\DMCmnUtils (0x63000 bytes).
2026-05-28 21:14:40,081 [root] DEBUG: 55848: DLL loaded at 0x6AD90000: C:\Windows\SYSTEM32\omadmapi (0x2c000 bytes).
2026-05-28 21:14:40,085 [root] DEBUG: 55848: DLL loaded at 0x6F290000: C:\Windows\SYSTEM32\UMPDC (0xd000 bytes).
2026-05-28 21:14:40,087 [root] DEBUG: 55848: DLL loaded at 0x70200000: C:\Windows\SYSTEM32\NTASN1 (0x28000 bytes).
2026-05-28 21:14:40,093 [root] DEBUG: 55848: DLL loaded at 0x70670000: C:\Windows\system32\netapi32 (0x14000 bytes).
2026-05-28 21:14:40,094 [root] DEBUG: 55848: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-28 21:14:40,096 [root] DEBUG: 55848: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\cryptsp (0x13000 bytes).
2026-05-28 21:14:40,098 [root] DEBUG: 55848: DLL loaded at 0x6EC40000: C:\Windows\SYSTEM32\DSREG (0x107000 bytes).
2026-05-28 21:14:40,106 [root] DEBUG: 55848: DLL loaded at 0x74180000: C:\Windows\SYSTEM32\profapi (0x1c000 bytes).
2026-05-28 21:14:40,126 [root] DEBUG: 55848: OpenProcessHandler: Injection info created for process 948, handle 0x480: C:\Windows\System32\svchost.exe
2026-05-28 21:14:40,131 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-28 21:14:40,132 [root] DEBUG: 55848: OpenProcessHandler: Injection info created for process 39860, handle 0x480: Error obtaining target process name
2026-05-28 21:14:40,134 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:40,135 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:40,141 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 55832: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x0000000000850000
2026-05-28 21:14:40,146 [root] INFO: Announced 32-bit process name: updater.exe pid: 55832
2026-05-28 21:14:40,147 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:40,148 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:40,149 [lib.api.process] INFO: Monitor config for process 55832: C:\lpw_albt\dll\55832.ini
2026-05-28 21:14:40,151 [root] DEBUG: 39860: DLL loaded at 0x00007FFF524B0000: C:\Windows\System32\taskschd (0xac000 bytes).
2026-05-28 21:14:40,153 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:40,163 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:40,169 [root] DEBUG: Loader: Injecting process 55832 (thread 55840) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:40,171 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:40,174 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:40,177 [lib.api.process] INFO: Injected into 32-bit <Process 55832 updater.exe>
2026-05-28 21:14:40,188 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:40,191 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:40,195 [root] INFO: Announced 32-bit process name: updater.exe pid: 55832
2026-05-28 21:14:40,196 [lib.api.process] INFO: Monitor config for process 55832: C:\lpw_albt\dll\55832.ini
2026-05-28 21:14:40,197 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:40,205 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:40,211 [root] DEBUG: Loader: Injecting process 55832 (thread 55840) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:40,215 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:40,216 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:40,219 [lib.api.process] INFO: Injected into 32-bit <Process 55832 updater.exe>
2026-05-28 21:14:40,231 [root] DEBUG: 55832: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:40,231 [root] DEBUG: 55832: Interactive desktop enabled.
2026-05-28 21:14:40,233 [root] DEBUG: 55832: Dropped file limit defaulting to 100.
2026-05-28 21:14:40,240 [root] DEBUG: 55832: Disabling sleep skipping.
2026-05-28 21:14:40,244 [root] DEBUG: 55832: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:40,245 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,284 [root] DEBUG: 55832: Monitor initialised: 32-bit capemon loaded in process 55832 at 0x6ae20000, thread 55840, image base 0x850000, stack from 0x52f4000-0x5300000
2026-05-28 21:14:40,286 [root] DEBUG: 55832: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --wake-all --system
2026-05-28 21:14:40,311 [root] DEBUG: 55832: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:40,325 [root] DEBUG: 55832: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:40,328 [root] DEBUG: 55832: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:40,333 [root] DEBUG: 55832: Hooked 632 out of 632 functions
2026-05-28 21:14:40,372 [root] DEBUG: 55832: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:40,375 [root] DEBUG: 55832: RestoreHeaders: Restored original import table.
2026-05-28 21:14:40,377 [root] INFO: Loaded monitor into process with pid 55832
2026-05-28 21:14:40,382 [root] DEBUG: 55832: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 55840).
2026-05-28 21:14:40,384 [root] DEBUG: 55832: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:40,387 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,425 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,464 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,504 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,541 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,579 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,621 [root] DEBUG: 55832: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:40,624 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,625 [root] DEBUG: 55832: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00B218AC, thread 55840).
2026-05-28 21:14:40,630 [root] DEBUG: 55832: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,666 [root] DEBUG: 55832: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:40,667 [root] DEBUG: 55832: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:40,671 [root] DEBUG: 55832: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 3.815347e-06)
2026-05-28 21:14:40,674 [root] DEBUG: 55832: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:40,676 [root] DEBUG: 55832: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:40,683 [root] DEBUG: 55832: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:40,686 [root] DEBUG: 55832: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:40,690 [root] DEBUG: 55832: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:40,694 [root] DEBUG: 55832: OpenProcessHandler: Injection info created for process 39860, handle 0x2d4: C:\Program Files\Google\Chrome\Application\chrome.exe
2026-05-28 21:14:40,699 [root] DEBUG: 55832: CreateProcessHandler: Injection info set for new process 56408: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x00850000
2026-05-28 21:14:40,701 [root] INFO: Announced 32-bit process name: updater.exe pid: 56408
2026-05-28 21:14:40,702 [lib.api.process] INFO: Monitor config for process 56408: C:\lpw_albt\dll\56408.ini
2026-05-28 21:14:40,706 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:40,720 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:40,727 [root] DEBUG: Loader: Injecting process 56408 (thread 56412) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:40,730 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:40,732 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:40,734 [lib.api.process] INFO: Injected into 32-bit <Process 56408 updater.exe>
2026-05-28 21:14:40,738 [root] DEBUG: 55832: DLL loaded at 0x74960000: C:\Windows\system32\apphelp (0x9f000 bytes).
2026-05-28 21:14:40,747 [root] DEBUG: 56408: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:40,749 [root] DEBUG: 56408: Interactive desktop enabled.
2026-05-28 21:14:40,750 [root] DEBUG: 56408: Dropped file limit defaulting to 100.
2026-05-28 21:14:40,758 [root] DEBUG: 56408: Disabling sleep skipping.
2026-05-28 21:14:40,759 [root] DEBUG: 56408: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:40,761 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,800 [root] DEBUG: 56408: Monitor initialised: 32-bit capemon loaded in process 56408 at 0x6ae20000, thread 56412, image base 0x850000, stack from 0x4fd4000-0x4fe0000
2026-05-28 21:14:40,804 [root] DEBUG: 56408: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2f4,0xe08584,0xe08
2026-05-28 21:14:40,841 [root] DEBUG: 56408: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:40,857 [root] DEBUG: 56408: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:40,859 [root] DEBUG: 56408: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:40,865 [root] DEBUG: 56408: Hooked 632 out of 632 functions
2026-05-28 21:14:40,904 [root] DEBUG: 56408: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:40,910 [root] DEBUG: 56408: RestoreHeaders: Restored original import table.
2026-05-28 21:14:40,912 [root] INFO: Loaded monitor into process with pid 56408
2026-05-28 21:14:40,918 [root] DEBUG: 56408: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 56412).
2026-05-28 21:14:40,922 [root] DEBUG: 56408: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:40,926 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:40,965 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,009 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,055 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,094 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,133 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,170 [root] DEBUG: 56408: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:41,172 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,175 [root] DEBUG: 56408: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00B218AC, thread 56412).
2026-05-28 21:14:41,177 [root] DEBUG: 56408: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,214 [root] DEBUG: 56408: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:41,217 [root] DEBUG: 56408: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:41,221 [root] DEBUG: 56408: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 3.815347e-06)
2026-05-28 21:14:41,226 [root] DEBUG: 56408: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:41,231 [root] DEBUG: 56408: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:41,236 [root] DEBUG: 56408: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:41,239 [root] DEBUG: 56408: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:41,245 [root] DEBUG: 56408: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:41,250 [root] DEBUG: 56408: OpenProcessHandler: Image base for process 55832 (handle 0x2d4): 0x00850000.
2026-05-28 21:14:41,252 [root] DEBUG: 56408: OpenProcessHandler: Injection info created for process 55832, handle 0x2d4: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
2026-05-28 21:14:41,261 [root] DEBUG: 56408: DLL loaded at 0x75640000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2026-05-28 21:14:41,289 [root] DEBUG: 55832: DLL loaded at 0x74950000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-28 21:14:41,292 [root] DEBUG: 55832: DLL loaded at 0x76650000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-05-28 21:14:41,303 [root] DEBUG: 55832: OpenProcessHandler: Injection info created for process 4484, handle 0x38c: C:\Windows\explorer.exe
2026-05-28 21:14:41,322 [root] DEBUG: 55832: CreateProcessHandler: Injection info set for new process 56732: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x00850000
2026-05-28 21:14:41,329 [root] INFO: Announced 32-bit process name: updater.exe pid: 56732
2026-05-28 21:14:41,331 [lib.api.process] INFO: Monitor config for process 56732: C:\lpw_albt\dll\56732.ini
2026-05-28 21:14:41,336 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:41,350 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:41,356 [root] DEBUG: Loader: Injecting process 56732 (thread 56736) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:41,358 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:41,359 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:41,362 [lib.api.process] INFO: Injected into 32-bit <Process 56732 updater.exe>
2026-05-28 21:14:41,374 [root] DEBUG: 56732: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:41,375 [root] DEBUG: 56732: Interactive desktop enabled.
2026-05-28 21:14:41,376 [root] DEBUG: 56732: Dropped file limit defaulting to 100.
2026-05-28 21:14:41,382 [root] DEBUG: 56732: Disabling sleep skipping.
2026-05-28 21:14:41,384 [root] DEBUG: 56732: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:41,386 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,423 [root] DEBUG: 56732: Monitor initialised: 32-bit capemon loaded in process 56732 at 0x6ae20000, thread 56736, image base 0x850000, stack from 0x1a5000-0x1b0000
2026-05-28 21:14:41,426 [root] DEBUG: 56732: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --wake --system
2026-05-28 21:14:41,451 [root] DEBUG: 56732: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:41,472 [root] DEBUG: 56732: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:41,474 [root] DEBUG: 56732: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:41,479 [root] DEBUG: 56732: Hooked 632 out of 632 functions
2026-05-28 21:14:41,519 [root] DEBUG: 56732: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:41,523 [root] DEBUG: 56732: RestoreHeaders: Restored original import table.
2026-05-28 21:14:41,524 [root] INFO: Loaded monitor into process with pid 56732
2026-05-28 21:14:41,530 [root] DEBUG: 56732: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 56736).
2026-05-28 21:14:41,532 [root] DEBUG: 56732: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:41,533 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,573 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,611 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,649 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,687 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,725 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,763 [root] DEBUG: 56732: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:41,764 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,767 [root] DEBUG: 56732: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00B218AC, thread 56736).
2026-05-28 21:14:41,768 [root] DEBUG: 56732: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,806 [root] DEBUG: 56732: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:41,808 [root] DEBUG: 56732: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:41,810 [root] DEBUG: 56732: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 3.815347e-06)
2026-05-28 21:14:41,815 [root] DEBUG: 56732: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:41,820 [root] DEBUG: 56732: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:41,824 [root] DEBUG: 56732: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:41,825 [root] DEBUG: 56732: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:41,831 [root] DEBUG: 56732: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:41,836 [root] DEBUG: 56732: OpenProcessHandler: Image base for process 55832 (handle 0x2d4): 0x00850000.
2026-05-28 21:14:41,838 [root] DEBUG: 56732: OpenProcessHandler: Injection info created for process 55832, handle 0x2d4: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
2026-05-28 21:14:41,873 [root] DEBUG: 56732: CreateProcessHandler: Injection info set for new process 56972: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x00850000
2026-05-28 21:14:41,875 [root] INFO: Announced 32-bit process name: updater.exe pid: 56972
2026-05-28 21:14:41,875 [lib.api.process] INFO: Monitor config for process 56972: C:\lpw_albt\dll\56972.ini
2026-05-28 21:14:41,880 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:41,887 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:41,892 [root] DEBUG: Loader: Injecting process 56972 (thread 56976) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:41,894 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:41,896 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:41,898 [lib.api.process] INFO: Injected into 32-bit <Process 56972 updater.exe>
2026-05-28 21:14:41,900 [root] DEBUG: 56732: DLL loaded at 0x74960000: C:\Windows\system32\apphelp (0x9f000 bytes).
2026-05-28 21:14:41,910 [root] DEBUG: 56972: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:41,912 [root] DEBUG: 56972: Interactive desktop enabled.
2026-05-28 21:14:41,913 [root] DEBUG: 56972: Dropped file limit defaulting to 100.
2026-05-28 21:14:41,919 [root] DEBUG: 56972: Disabling sleep skipping.
2026-05-28 21:14:41,922 [root] DEBUG: 56972: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:41,923 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:41,962 [root] DEBUG: 56972: Monitor initialised: 32-bit capemon loaded in process 56972 at 0x6ae20000, thread 56976, image base 0x850000, stack from 0x4f5000-0x500000
2026-05-28 21:14:41,964 [root] DEBUG: 56972: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2e8,0x2ec,0x2d8,0x2e4,0x2dc,0xe08584,0xe08
2026-05-28 21:14:41,990 [root] DEBUG: 56972: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:42,003 [root] DEBUG: 56972: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:42,005 [root] DEBUG: 56972: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:42,010 [root] DEBUG: 56972: Hooked 632 out of 632 functions
2026-05-28 21:14:42,048 [root] DEBUG: 56972: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:42,051 [root] DEBUG: 56972: RestoreHeaders: Restored original import table.
2026-05-28 21:14:42,052 [root] INFO: Loaded monitor into process with pid 56972
2026-05-28 21:14:42,058 [root] DEBUG: 56972: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 56976).
2026-05-28 21:14:42,058 [root] DEBUG: 56972: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:42,061 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:42,100 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:42,137 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:42,177 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:42,216 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:42,256 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:42,294 [root] DEBUG: 56972: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:42,295 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:42,297 [root] DEBUG: 56972: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00B218AC, thread 56976).
2026-05-28 21:14:42,298 [root] DEBUG: 56972: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:42,338 [root] DEBUG: 56972: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:42,340 [root] DEBUG: 56972: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:42,344 [root] DEBUG: 56972: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:42,351 [root] DEBUG: 56972: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:42,354 [root] DEBUG: 56972: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:42,358 [root] DEBUG: 56972: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:42,360 [root] DEBUG: 56972: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:42,367 [root] DEBUG: 56972: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:42,374 [root] DEBUG: 56972: OpenProcessHandler: Image base for process 56732 (handle 0x300): 0x00850000.
2026-05-28 21:14:42,375 [root] DEBUG: 56972: OpenProcessHandler: Injection info created for process 56732, handle 0x300: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
2026-05-28 21:14:42,384 [root] DEBUG: 56972: DLL loaded at 0x75640000: C:\Windows\System32\MSCTF (0xd4000 bytes).
2026-05-28 21:14:42,402 [root] DEBUG: 56732: DLL loaded at 0x74950000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-28 21:14:42,406 [root] DEBUG: 56732: DLL loaded at 0x76650000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-05-28 21:14:42,416 [root] DEBUG: 56732: OpenProcessHandler: Injection info created for process 4484, handle 0x384: C:\Windows\explorer.exe
2026-05-28 21:14:42,439 [root] INFO: Announced starting service "b'GoogleUpdaterInternalService149.0.7814.0'"
2026-05-28 21:14:43,445 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 57320: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x0000000000850000
2026-05-28 21:14:43,447 [root] INFO: Announced 32-bit process name: updater.exe pid: 57320
2026-05-28 21:14:43,448 [lib.api.process] INFO: Monitor config for process 57320: C:\lpw_albt\dll\57320.ini
2026-05-28 21:14:43,451 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:43,462 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:43,469 [root] DEBUG: Loader: Injecting process 57320 (thread 57324) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:43,470 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:43,471 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:43,473 [lib.api.process] INFO: Injected into 32-bit <Process 57320 updater.exe>
2026-05-28 21:14:43,476 [root] INFO: Announced 32-bit process name: updater.exe pid: 57320
2026-05-28 21:14:43,477 [lib.api.process] INFO: Monitor config for process 57320: C:\lpw_albt\dll\57320.ini
2026-05-28 21:14:43,479 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:43,487 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:43,493 [root] DEBUG: Loader: Injecting process 57320 (thread 57324) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:43,494 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:43,496 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:43,498 [lib.api.process] INFO: Injected into 32-bit <Process 57320 updater.exe>
2026-05-28 21:14:43,500 [root] INFO: Announced 32-bit process name: updater.exe pid: 57320
2026-05-28 21:14:43,501 [lib.api.process] INFO: Monitor config for process 57320: C:\lpw_albt\dll\57320.ini
2026-05-28 21:14:43,502 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:43,513 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:43,518 [root] DEBUG: Loader: Injecting process 57320 with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:43,519 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2026-05-28 21:14:43,529 [root] DEBUG: 57320: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:43,531 [root] DEBUG: 57320: Interactive desktop enabled.
2026-05-28 21:14:43,532 [root] DEBUG: 57320: Dropped file limit defaulting to 100.
2026-05-28 21:14:43,538 [root] DEBUG: 57320: Disabling sleep skipping.
2026-05-28 21:14:43,539 [root] DEBUG: 57320: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:43,541 [root] DEBUG: 57320: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:43,578 [root] DEBUG: 57320: Monitor initialised: 32-bit capemon loaded in process 57320 at 0x6ae20000, thread 57000, image base 0x850000, stack from 0x52f5000-0x5300000
2026-05-28 21:14:43,580 [root] DEBUG: 57320: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update-internal
2026-05-28 21:14:43,607 [root] DEBUG: 57320: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:43,622 [root] DEBUG: 57320: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:43,623 [root] DEBUG: 57320: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:43,629 [root] DEBUG: 57320: Hooked 632 out of 632 functions
2026-05-28 21:14:43,666 [root] DEBUG: 57320: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:43,671 [root] DEBUG: 57320: RestoreHeaders: Restored original import table.
2026-05-28 21:14:43,672 [root] INFO: Loaded monitor into process with pid 57320
2026-05-28 21:14:43,678 [root] DEBUG: 57320: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 57000).
2026-05-28 21:14:43,679 [root] DEBUG: 57320: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:43,681 [root] DEBUG: 57320: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:43,720 [root] DEBUG: 57320: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:43,757 [root] DEBUG: 57320: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:43,795 [root] DEBUG: 57320: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:43,834 [root] DEBUG: 57320: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:43,873 [root] DEBUG: 57320: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:43,911 [root] DEBUG: 57320: caller_dispatch: Added region at 0x04EE0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x04EE0037, thread 57000).
2026-05-28 21:14:43,913 [root] DEBUG: 57320: DumpPEsInRange: Scanning range 0x04EE0000 - 0x04EE0129.
2026-05-28 21:14:43,914 [root] DEBUG: 57320: ScanForDisguisedPE: Size too small: 0x129 bytes
2026-05-28 21:14:43,917 [root] DEBUG: 57320: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::LdrLoadDll returns to 0x00A551D4, thread 57300).
2026-05-28 21:14:43,922 [root] DEBUG: 57320: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:43,927 [root] DEBUG: 57320: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:43,929 [lib.common.results] INFO: Uploading file C:\EsskdWmsyS\CAPE\57320_45276704314129552026 to CAPE\4ab5c71a7ec270055980898addfef6d2eef7b0826763204bd47141c36e005ed6; Size is 297; Max size: 100000000
2026-05-28 21:14:43,940 [root] DEBUG: 57320: DumpMemory: Payload successfully created: C:\EsskdWmsyS\CAPE\57320_45276704314129552026 (size 297 bytes)
2026-05-28 21:14:43,942 [root] DEBUG: 57320: DumpRegion: Dumped entire allocation from 0x04EE0000, size 4096 bytes.
2026-05-28 21:14:43,947 [root] DEBUG: 57320: ProcessTrackedRegion: Dumped region at 0x04EE0000.
2026-05-28 21:14:43,949 [root] DEBUG: 57320: YaraScan: Scanning 0x04EE0000, size 0x129
2026-05-28 21:14:43,970 [root] DEBUG: 57320: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:43,972 [root] DEBUG: 57320: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:43,976 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 21:14:43,979 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:43,987 [lib.api.process] INFO: Injected into 32-bit <Process 57320 updater.exe>
2026-05-28 21:14:43,995 [root] DEBUG: 57320: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:43,997 [root] DEBUG: 57320: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:44,001 [root] DEBUG: 57320: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:44,003 [root] DEBUG: 57320: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:44,008 [root] DEBUG: 57320: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:44,026 [root] DEBUG: 57320: CreateProcessHandler: Injection info set for new process 57472: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x00850000
2026-05-28 21:14:44,028 [root] INFO: Announced 32-bit process name: updater.exe pid: 57472
2026-05-28 21:14:44,030 [lib.api.process] INFO: Monitor config for process 57472: C:\lpw_albt\dll\57472.ini
2026-05-28 21:14:44,037 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:44,047 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:44,054 [root] DEBUG: Loader: Injecting process 57472 (thread 57476) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:44,056 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:44,057 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:44,059 [lib.api.process] INFO: Injected into 32-bit <Process 57472 updater.exe>
2026-05-28 21:14:44,061 [root] DEBUG: 57320: DLL loaded at 0x74960000: C:\Windows\system32\apphelp (0x9f000 bytes).
2026-05-28 21:14:44,072 [root] DEBUG: 57472: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:44,074 [root] DEBUG: 57472: Interactive desktop enabled.
2026-05-28 21:14:44,074 [root] DEBUG: 57472: Dropped file limit defaulting to 100.
2026-05-28 21:14:44,081 [root] DEBUG: 57472: Disabling sleep skipping.
2026-05-28 21:14:44,083 [root] DEBUG: 57472: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:44,085 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,124 [root] DEBUG: 57472: Monitor initialised: 32-bit capemon loaded in process 57472 at 0x6ae20000, thread 57476, image base 0x850000, stack from 0x52f5000-0x5300000
2026-05-28 21:14:44,126 [root] DEBUG: 57472: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2ec,0xe08584,0xe08
2026-05-28 21:14:44,158 [root] DEBUG: 57472: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:44,178 [root] DEBUG: 57472: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:44,182 [root] DEBUG: 57472: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:44,191 [root] DEBUG: 57472: Hooked 632 out of 632 functions
2026-05-28 21:14:44,232 [root] DEBUG: 57472: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:44,235 [root] DEBUG: 57472: RestoreHeaders: Restored original import table.
2026-05-28 21:14:44,237 [root] INFO: Loaded monitor into process with pid 57472
2026-05-28 21:14:44,243 [root] DEBUG: 57472: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 57476).
2026-05-28 21:14:44,244 [root] DEBUG: 57472: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:44,246 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,284 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,321 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,359 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,397 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,435 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,474 [root] DEBUG: 57472: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:44,483 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,484 [root] DEBUG: 57472: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00B218AC, thread 57476).
2026-05-28 21:14:44,485 [root] DEBUG: 57472: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:44,525 [root] DEBUG: 57472: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:44,527 [root] DEBUG: 57472: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:44,528 [root] DEBUG: 57472: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:44,533 [root] DEBUG: 57472: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:44,537 [root] DEBUG: 57472: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:44,542 [root] DEBUG: 57472: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:44,546 [root] DEBUG: 57472: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:44,551 [root] DEBUG: 57472: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:44,555 [root] DEBUG: 57472: OpenProcessHandler: Image base for process 57320 (handle 0x2f0): 0x00850000.
2026-05-28 21:14:44,558 [root] DEBUG: 57472: OpenProcessHandler: Injection info created for process 57320, handle 0x2f0: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
2026-05-28 21:14:44,580 [root] DEBUG: 57320: DLL loaded at 0x74950000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-28 21:14:44,585 [root] DEBUG: 57320: DLL loaded at 0x76650000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-05-28 21:14:44,593 [root] DEBUG: 57320: OpenProcessHandler: Injection info created for process 4484, handle 0x378: C:\Windows\explorer.exe
2026-05-28 21:14:49,228 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,230 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,232 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,233 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,234 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 57828: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:49,236 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 57828
2026-05-28 21:14:49,238 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,239 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,239 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,241 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,245 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,246 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,247 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,253 [root] DEBUG: 39860: DLL loaded at 0x00007FFF4DE90000: C:\Windows\SYSTEM32\wbemcomn (0x90000 bytes).
2026-05-28 21:14:49,255 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,257 [root] DEBUG: 39860: DLL loaded at 0x00007FFF3FD20000: C:\Windows\system32\wbem\wbemprox (0x11000 bytes).
2026-05-28 21:14:49,257 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 57828
2026-05-28 21:14:49,262 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,264 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,264 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,266 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,268 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 57916: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:49,269 [root] DEBUG: 39860: DLL loaded at 0x00007FFF3F950000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2026-05-28 21:14:49,270 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 57916
2026-05-28 21:14:49,277 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,278 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,280 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 57916
2026-05-28 21:14:49,281 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,282 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,283 [root] DEBUG: 39860: DLL loaded at 0x00007FFF3F9F0000: C:\Windows\system32\wbem\fastprox (0x10b000 bytes).
2026-05-28 21:14:49,285 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,289 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,290 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,290 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,295 [root] DEBUG: 39860: CreateProcessHandler: Injection info set for new process 58016: C:\Program Files\Google\Chrome\Application\chrome.exe, ImageBase: 0x00007FF7AD300000
2026-05-28 21:14:49,295 [root] DEBUG: 39860: DLL loaded at 0x00007FFF3F880000: C:\Windows\SYSTEM32\amsi (0x1f000 bytes).
2026-05-28 21:14:49,296 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,297 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 58016
2026-05-28 21:14:49,298 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,301 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,307 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,307 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,308 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,310 [root] DEBUG: 39860: ProcessMessage: Skipping monitoring process 58016
2026-05-28 21:14:49,311 [root] DEBUG: 39860: DLL loaded at 0x00007FFF3F830000: C:\Program Files\Windows Defender\MpOav (0x44000 bytes).
2026-05-28 21:14:49,315 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,320 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,321 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,323 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:49,346 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:49,349 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:50,060 [root] INFO: Added new file to list with pid 55848 and path C:\Program Files (x86)\Google\GoogleUpdater\ca421c60-8f17-40ad-a01c-15790365d31c.tmp
2026-05-28 21:14:50,062 [root] INFO: Error dumping file from path "C:\Program Files (x86)\Google\GoogleUpdater\7b561a3e-8102-4a63-9d4a-a3edf0b7f0ef.tmp": [Errno 13] Permission denied: 'C:\\Program Files (x86)\\Google\\GoogleUpdater\\7b561a3e-8102-4a63-9d4a-a3edf0b7f0ef.tmp'
2026-05-28 21:14:50,064 [root] INFO: Error dumping file from path "C:\Program Files (x86)\Google\GoogleUpdater\7b561a3e-8102-4a63-9d4a-a3edf0b7f0ef.tmp": [Errno 13] Permission denied: 'C:\\Program Files (x86)\\Google\\GoogleUpdater\\7b561a3e-8102-4a63-9d4a-a3edf0b7f0ef.tmp'
2026-05-28 21:14:50,080 [lib.common.results] INFO: Uploading file C:\Program Files (x86)\Google\GoogleUpdater\7b561a3e-8102-4a63-9d4a-a3edf0b7f0ef.tmp to files\521174c9154b3723c324b46f561c51e53e5ea0c35eea009153b0a01ee030f03a; Size is 1347; Max size: 100000000
2026-05-28 21:14:50,166 [root] INFO: Process with pid 55848 has terminated
2026-05-28 21:14:50,168 [root] DEBUG: 55848: NtTerminateProcess hook: Attempting to dump process 55848
2026-05-28 21:14:50,170 [root] DEBUG: 57320: OpenProcessHandler: Injection info created for process 948, handle 0x448: C:\Windows\System32\svchost.exe
2026-05-28 21:14:50,172 [root] DEBUG: 55848: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:14:50,179 [root] DEBUG: 57320: DLL loaded at 0x748C0000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-05-28 21:14:50,189 [root] INFO: Process with pid 56176 has terminated
2026-05-28 21:14:50,191 [root] DEBUG: 56176: NtTerminateProcess hook: Attempting to dump process 56176
2026-05-28 21:14:50,192 [root] DEBUG: 56732: DLL loaded at 0x748C0000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-05-28 21:14:50,195 [root] DEBUG: 56176: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:14:50,272 [root] INFO: Announced starting service "b'GoogleUpdaterService149.0.7814.0'"
2026-05-28 21:14:51,288 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 57508: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x0000000000850000
2026-05-28 21:14:51,291 [root] INFO: Announced 32-bit process name: updater.exe pid: 57508
2026-05-28 21:14:51,292 [lib.api.process] INFO: Monitor config for process 57508: C:\lpw_albt\dll\57508.ini
2026-05-28 21:14:51,294 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:51,303 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:51,313 [root] DEBUG: Loader: Injecting process 57508 (thread 57504) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:51,319 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:51,321 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:51,323 [lib.api.process] INFO: Injected into 32-bit <Process 57508 updater.exe>
2026-05-28 21:14:51,325 [root] INFO: Announced 32-bit process name: updater.exe pid: 57508
2026-05-28 21:14:51,329 [lib.api.process] INFO: Monitor config for process 57508: C:\lpw_albt\dll\57508.ini
2026-05-28 21:14:51,330 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:51,341 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:51,347 [root] DEBUG: Loader: Injecting process 57508 (thread 57504) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:51,351 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-28 21:14:51,352 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:51,356 [lib.api.process] INFO: Injected into 32-bit <Process 57508 updater.exe>
2026-05-28 21:14:51,357 [root] INFO: Announced 32-bit process name: updater.exe pid: 57508
2026-05-28 21:14:51,364 [lib.api.process] INFO: Monitor config for process 57508: C:\lpw_albt\dll\57508.ini
2026-05-28 21:14:51,366 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:51,378 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:51,394 [root] DEBUG: Loader: Injecting process 57508 with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:51,395 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2026-05-28 21:14:51,406 [root] DEBUG: 57508: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:51,409 [root] DEBUG: 57508: Interactive desktop enabled.
2026-05-28 21:14:51,409 [root] DEBUG: 57508: Dropped file limit defaulting to 100.
2026-05-28 21:14:51,418 [root] DEBUG: 57508: Disabling sleep skipping.
2026-05-28 21:14:51,424 [root] DEBUG: 57508: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:51,425 [root] DEBUG: 57508: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:51,465 [root] DEBUG: 57508: Monitor initialised: 32-bit capemon loaded in process 57508 at 0x6ae20000, thread 57972, image base 0x850000, stack from 0x5124000-0x5130000
2026-05-28 21:14:51,466 [root] DEBUG: 57508: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update
2026-05-28 21:14:51,494 [root] DEBUG: 57508: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:51,508 [root] DEBUG: 57508: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:51,511 [root] DEBUG: 57508: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:51,515 [root] DEBUG: 57508: Hooked 632 out of 632 functions
2026-05-28 21:14:51,554 [root] DEBUG: 57508: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:51,559 [root] DEBUG: 57508: RestoreHeaders: Restored original import table.
2026-05-28 21:14:51,561 [root] INFO: Loaded monitor into process with pid 57508
2026-05-28 21:14:51,566 [root] DEBUG: 57508: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 57972).
2026-05-28 21:14:51,567 [root] DEBUG: 57508: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:51,571 [root] DEBUG: 57508: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:51,608 [root] DEBUG: 57508: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:51,645 [root] DEBUG: 57508: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:51,685 [root] DEBUG: 57508: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:51,724 [root] DEBUG: 57508: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:51,763 [root] DEBUG: 57508: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:51,803 [root] DEBUG: 57508: caller_dispatch: Added region at 0x04FE0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x04FE0037, thread 57972).
2026-05-28 21:14:51,805 [root] DEBUG: 57508: DumpPEsInRange: Scanning range 0x04FE0000 - 0x04FE0129.
2026-05-28 21:14:51,805 [root] DEBUG: 57508: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::LdrLoadDll returns to 0x00A551D4, thread 57988).
2026-05-28 21:14:51,808 [root] DEBUG: 57508: ScanForDisguisedPE: Size too small: 0x129 bytes
2026-05-28 21:14:51,809 [root] DEBUG: 57508: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:51,813 [lib.common.results] INFO: Uploading file C:\EsskdWmsyS\CAPE\57508_30371745114129552026 to CAPE\77f9f4828934222c68c2ef9c8144cca78ffe72c7155b2d1077ca8bb94fa81d7a; Size is 297; Max size: 100000000
2026-05-28 21:14:51,814 [root] DEBUG: 57508: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:51,829 [root] DEBUG: 57508: DumpMemory: Payload successfully created: C:\EsskdWmsyS\CAPE\57508_30371745114129552026 (size 297 bytes)
2026-05-28 21:14:51,831 [root] DEBUG: 57508: DumpRegion: Dumped entire allocation from 0x04FE0000, size 4096 bytes.
2026-05-28 21:14:51,835 [root] DEBUG: 57508: ProcessTrackedRegion: Dumped region at 0x04FE0000.
2026-05-28 21:14:51,836 [root] DEBUG: 57508: YaraScan: Scanning 0x04FE0000, size 0x129
2026-05-28 21:14:51,856 [root] DEBUG: 57508: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:51,859 [root] DEBUG: 57508: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:51,862 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-28 21:14:51,863 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:51,871 [lib.api.process] INFO: Injected into 32-bit <Process 57508 updater.exe>
2026-05-28 21:14:51,880 [root] DEBUG: 57508: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:51,883 [root] DEBUG: 57508: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:51,888 [root] DEBUG: 57508: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:51,889 [root] DEBUG: 57508: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:51,894 [root] DEBUG: 57508: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:51,903 [root] DEBUG: 57508: CreateProcessHandler: Injection info set for new process 56236: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe, ImageBase: 0x00850000
2026-05-28 21:14:51,907 [root] INFO: Announced 32-bit process name: updater.exe pid: 56236
2026-05-28 21:14:51,910 [lib.api.process] INFO: Monitor config for process 56236: C:\lpw_albt\dll\56236.ini
2026-05-28 21:14:51,915 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-28 21:14:51,928 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\qdlELYDm.dll, loader C:\lpw_albt\bin\AKGnKOB.exe
2026-05-28 21:14:51,934 [root] DEBUG: Loader: Injecting process 56236 (thread 56268) with C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:51,935 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-28 21:14:51,938 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\qdlELYDm.dll.
2026-05-28 21:14:51,940 [lib.api.process] INFO: Injected into 32-bit <Process 56236 updater.exe>
2026-05-28 21:14:51,944 [root] DEBUG: 57508: DLL loaded at 0x74960000: C:\Windows\system32\apphelp (0x9f000 bytes).
2026-05-28 21:14:51,955 [root] DEBUG: 56236: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-28 21:14:51,956 [root] DEBUG: 56236: Interactive desktop enabled.
2026-05-28 21:14:51,960 [root] DEBUG: 56236: Dropped file limit defaulting to 100.
2026-05-28 21:14:51,966 [root] DEBUG: 56236: Disabling sleep skipping.
2026-05-28 21:14:51,972 [root] DEBUG: 56236: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-28 21:14:51,973 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,011 [root] DEBUG: 56236: Monitor initialised: 32-bit capemon loaded in process 56236 at 0x6ae20000, thread 56268, image base 0x850000, stack from 0x52f5000-0x5300000
2026-05-28 21:14:52,013 [root] DEBUG: 56236: Commandline: "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2e0,0x2a8,0x2ac,0x2dc,0x2d8,0xe08584,0xe08
2026-05-28 21:14:52,040 [root] DEBUG: 56236: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-28 21:14:52,056 [root] DEBUG: 56236: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-28 21:14:52,058 [root] DEBUG: 56236: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-28 21:14:52,063 [root] DEBUG: 56236: Hooked 632 out of 632 functions
2026-05-28 21:14:52,099 [root] DEBUG: 56236: Syscall hook installed, syscall logging level 1
2026-05-28 21:14:52,104 [root] DEBUG: 56236: RestoreHeaders: Restored original import table.
2026-05-28 21:14:52,111 [root] INFO: Loaded monitor into process with pid 56236
2026-05-28 21:14:52,116 [root] DEBUG: 56236: InstrumentationCallback: Added region at 0x75FB274C (base 0x75F90000) to tracked regions list (thread 56268).
2026-05-28 21:14:52,118 [root] DEBUG: 56236: ProcessTrackedRegion: Region at 0x75F90000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\kernel32.dll is in known range, skipping
2026-05-28 21:14:52,121 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,161 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,201 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,242 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,280 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,318 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,356 [root] DEBUG: 56236: caller_dispatch: Scanning calling region at 0x00850000...
2026-05-28 21:14:52,358 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,360 [root] DEBUG: 56236: caller_dispatch: Added region at 0x00850000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00B218AC, thread 56268).
2026-05-28 21:14:52,361 [root] DEBUG: 56236: YaraScan: Scanning 0x00850000, size 0x686738
2026-05-28 21:14:52,404 [root] DEBUG: 56236: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:52,405 [root] DEBUG: 56236: ProcessImageBase: Main module image at 0x00850000 unmodified (entropy change 0.000000e+00)
2026-05-28 21:14:52,407 [root] DEBUG: 56236: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptprimitives (0x5f000 bytes).
2026-05-28 21:14:52,414 [root] DEBUG: 56236: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:52,417 [root] DEBUG: 56236: DLL loaded at 0x75F00000: C:\Windows\System32\shcore (0x87000 bytes).
2026-05-28 21:14:52,421 [root] DEBUG: 56236: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-28 21:14:52,424 [root] DEBUG: 56236: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-28 21:14:52,428 [root] DEBUG: 56236: DLL loaded at 0x74A00000: C:\Windows\SYSTEM32\ntmarta (0x29000 bytes).
2026-05-28 21:14:52,433 [root] DEBUG: 56236: OpenProcessHandler: Image base for process 57508 (handle 0x2f0): 0x00850000.
2026-05-28 21:14:52,434 [root] DEBUG: 56236: OpenProcessHandler: Injection info created for process 57508, handle 0x2f0: C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
2026-05-28 21:14:52,458 [root] DEBUG: 57508: DLL loaded at 0x74950000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-28 21:14:52,460 [root] DEBUG: 57508: DLL loaded at 0x76650000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-05-28 21:14:52,469 [root] DEBUG: 57508: OpenProcessHandler: Injection info created for process 4484, handle 0x378: C:\Windows\explorer.exe
2026-05-28 21:14:52,529 [root] DEBUG: 57508: DLL loaded at 0x748A0000: C:\Windows\SYSTEM32\wkscli (0x11000 bytes).
2026-05-28 21:14:52,533 [root] DEBUG: 57508: DLL loaded at 0x74890000: C:\Windows\SYSTEM32\netutils (0xb000 bytes).
2026-05-28 21:14:52,536 [root] DEBUG: 57508: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-28 21:14:52,537 [root] DEBUG: 57508: DLL loaded at 0x6ADC0000: C:\Windows\SYSTEM32\MDMRegistration (0x53000 bytes).
2026-05-28 21:14:52,545 [root] DEBUG: 57508: DLL loaded at 0x6F2A0000: C:\Windows\SYSTEM32\powrprof (0x44000 bytes).
2026-05-28 21:14:52,546 [root] DEBUG: 57508: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2026-05-28 21:14:52,547 [root] DEBUG: 57508: DLL loaded at 0x70D00000: C:\Windows\SYSTEM32\ncrypt (0x21000 bytes).
2026-05-28 21:14:52,548 [root] DEBUG: 57508: DLL loaded at 0x76790000: C:\Windows\System32\imagehlp (0x19000 bytes).
2026-05-28 21:14:52,550 [root] DEBUG: 57508: DLL loaded at 0x6AD00000: C:\Windows\SYSTEM32\tbs (0x13000 bytes).
2026-05-28 21:14:52,551 [root] DEBUG: 57508: DLL loaded at 0x6AD20000: C:\Windows\SYSTEM32\DMCmnUtils (0x63000 bytes).
2026-05-28 21:14:52,552 [root] DEBUG: 57508: DLL loaded at 0x6AD90000: C:\Windows\SYSTEM32\omadmapi (0x2c000 bytes).
2026-05-28 21:14:52,557 [root] DEBUG: 57508: DLL loaded at 0x6F290000: C:\Windows\SYSTEM32\UMPDC (0xd000 bytes).
2026-05-28 21:14:52,560 [root] DEBUG: 57508: DLL loaded at 0x70200000: C:\Windows\SYSTEM32\NTASN1 (0x28000 bytes).
2026-05-28 21:14:52,566 [root] DEBUG: 57508: DLL loaded at 0x70670000: C:\Windows\system32\netapi32 (0x14000 bytes).
2026-05-28 21:14:52,569 [root] DEBUG: 57508: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-28 21:14:52,570 [root] DEBUG: 57508: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\cryptsp (0x13000 bytes).
2026-05-28 21:14:52,572 [root] DEBUG: 57508: DLL loaded at 0x6EC40000: C:\Windows\SYSTEM32\DSREG (0x107000 bytes).
2026-05-28 21:14:52,580 [root] DEBUG: 57508: DLL loaded at 0x74180000: C:\Windows\SYSTEM32\profapi (0x1c000 bytes).
2026-05-28 21:14:52,600 [root] DEBUG: 57508: OpenProcessHandler: Injection info created for process 948, handle 0x478: C:\Windows\System32\svchost.exe
2026-05-28 21:14:52,604 [root] DEBUG: 57508: DLL loaded at 0x748C0000: C:\Windows\SYSTEM32\sxs (0x87000 bytes).
2026-05-28 21:14:52,709 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:14:52,711 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:14:54,847 [root] INFO: Process with pid 56732 has terminated
2026-05-28 21:14:54,849 [root] DEBUG: 56732: NtTerminateProcess hook: Attempting to dump process 56732
2026-05-28 21:14:54,853 [root] DEBUG: 56732: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:14:54,866 [root] INFO: Process with pid 56972 has terminated
2026-05-28 21:14:54,870 [root] DEBUG: 56972: NtTerminateProcess hook: Attempting to dump process 56972
2026-05-28 21:14:54,874 [root] INFO: Process with pid 55832 has terminated
2026-05-28 21:14:54,878 [root] DEBUG: 56972: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:14:54,879 [root] DEBUG: 55832: NtTerminateProcess hook: Attempting to dump process 55832
2026-05-28 21:14:54,883 [root] DEBUG: 55832: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:14:54,900 [root] INFO: Process with pid 56408 has terminated
2026-05-28 21:14:54,902 [root] DEBUG: 56408: NtTerminateProcess hook: Attempting to dump process 56408
2026-05-28 21:14:54,905 [root] DEBUG: 56408: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:14:59,888 [root] DEBUG: 4484: api-cap: NtSetInformationThread hook disabled due to count: 5000
2026-05-28 21:15:00,166 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:00,169 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:00,175 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:00,177 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,481 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,483 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,488 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,490 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,494 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,496 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,508 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,512 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,517 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,519 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,524 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,527 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,531 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,536 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,541 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,543 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,549 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,549 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,824 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,826 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,830 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,832 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,838 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,839 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,847 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,849 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:01,855 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:01,856 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:02,543 [root] INFO: Added new file to list with pid 57508 and path C:\Program Files (x86)\Google\GoogleUpdater\8864a617-d13e-4ba5-8384-d9817f27bf3f.tmp
2026-05-28 21:15:02,547 [root] INFO: Error dumping file from path "C:\Program Files (x86)\Google\GoogleUpdater\84dcf501-3a5f-47f8-9319-0844e4f33e43.tmp": [Errno 13] Permission denied: 'C:\\Program Files (x86)\\Google\\GoogleUpdater\\84dcf501-3a5f-47f8-9319-0844e4f33e43.tmp'
2026-05-28 21:15:02,550 [root] INFO: Error dumping file from path "C:\Program Files (x86)\Google\GoogleUpdater\84dcf501-3a5f-47f8-9319-0844e4f33e43.tmp": [Errno 13] Permission denied: 'C:\\Program Files (x86)\\Google\\GoogleUpdater\\84dcf501-3a5f-47f8-9319-0844e4f33e43.tmp'
2026-05-28 21:15:02,576 [lib.common.results] INFO: Uploading file C:\Program Files (x86)\Google\GoogleUpdater\84dcf501-3a5f-47f8-9319-0844e4f33e43.tmp to files\d8060018b99456ccbc4a1801c94c93423f1d2e345fa5a225176c92512e0372b6; Size is 1347; Max size: 100000000
2026-05-28 21:15:04,104 [root] DEBUG: 4484: api-cap: NtReadFile hook disabled due to count: 5000
2026-05-28 21:15:04,221 [root] DEBUG: 4484: api-cap: NtSetInformationFile hook disabled due to count: 5000
2026-05-28 21:15:04,838 [root] INFO: Process with pid 57508 has terminated
2026-05-28 21:15:04,839 [root] DEBUG: 57508: NtTerminateProcess hook: Attempting to dump process 57508
2026-05-28 21:15:04,843 [root] DEBUG: 57508: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:15:04,846 [root] INFO: Process with pid 57320 has terminated
2026-05-28 21:15:04,850 [root] DEBUG: 57320: NtTerminateProcess hook: Attempting to dump process 57320
2026-05-28 21:15:04,854 [root] DEBUG: 57320: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:15:04,862 [root] INFO: Process with pid 56236 has terminated
2026-05-28 21:15:04,863 [root] DEBUG: 56236: NtTerminateProcess hook: Attempting to dump process 56236
2026-05-28 21:15:04,871 [root] DEBUG: 56236: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:15:04,874 [root] INFO: Process with pid 57472 has terminated
2026-05-28 21:15:04,877 [root] DEBUG: 57472: NtTerminateProcess hook: Attempting to dump process 57472
2026-05-28 21:15:04,883 [root] DEBUG: 57472: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-28 21:15:07,537 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:07,540 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:07,555 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:07,556 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
2026-05-28 21:15:07,566 [root] DEBUG: 39860: ProcessTrackedRegion: Updated entropy for tracked region at 0x00007FFF138F0000: 6.266448e+00 (from 6.266012e+00)
2026-05-28 21:15:07,570 [root] DEBUG: 39860: ProcessTrackedRegion: Region at 0x00007FFF138F0000 mapped as \Device\HarddiskVolume2\Program Files\Google\Chrome\Application\148.0.7778.217\chrome_elf.dll is in known range, skipping
Process Log

        
Pre-Script Log

        
During-Script Log

        
Machine Information
Name Label Manager Started On Shutdown On Route
cuckoo1 cuckoo1 KVM 2026-05-28 21:11:50 2026-05-28 21:15:19 none
URL Details
Processing 11.27s
  • 7.109s CAPE
  • 2.834s BehaviorAnalysis
  • 0.782s NetworkAnalysis
  • 0.525s UrlAnalysis
  • 0.017s AnalysisInfo
  • 0.001s Debug
Signatures 2.62s
  • 0.919s antiav_detectreg
  • 0.311s infostealer_ftp
  • 0.298s territorial_disputes_sigs
  • 0.191s antianalysis_detectreg
  • 0.173s infostealer_im
  • 0.108s antivm_vbox_keys
  • 0.069s antivm_vmware_keys
  • 0.055s antivm_parallels_keys
  • 0.052s antivm_xen_keys
  • 0.049s odbcconf_bypass
  • 0.037s antivm_generic_diskreg
  • 0.035s antivm_vpc_keys
  • 0.034s infostealer_mail
  • 0.031s uses_windows_utilities
  • 0.029s suspicious_command_tools
  • 0.017s antivm_bochs_keys
  • 0.017s antivm_hyperv_keys
  • 0.017s bypass_firewall
  • 0.012s masquerade_process_name
  • 0.01s antivm_generic_bios
  • 0.009s antiav_detectfile
  • 0.008s ketrican_regkeys
  • 0.007s browser_security
  • 0.007s disables_windows_defender_logging
  • 0.007s removes_windows_defender_contextmenu
  • 0.007s recon_fingerprint
  • 0.006s disables_browser_warn
  • 0.006s ransomware_files
  • 0.005s infostealer_bitcoin
  • 0.004s antianalysis_detectfile
  • 0.004s antivm_vbox_files
  • 0.004s network_dns_url_shortener
  • 0.004s language_check_registry
  • 0.003s browser_addon
  • 0.003s checks_uac_status
  • 0.003s discover_registry_mount_points
  • 0.003s suspicious_tld
  • 0.003s packer_armadillo_regkey
  • 0.003s ransomware_extensions_known
  • 0.002s network_dyndns
  • 0.002s accesses_netlogon_regkey
  • 0.002s antidebug_devices
  • 0.002s uac_bypass_cmstpcom
  • 0.002s registry_lsa_secrets_access
  • 0.002s disables_system_restore
  • 0.002s disables_windows_defender
  • 0.002s modify_security_center_warnings
  • 0.002s modify_uac_prompt
  • 0.002s accesses_office_username
  • 0.002s stealth_hiddenreg
  • 0.001s network_open_proxy
  • 0.001s network_torgateway
  • 0.001s recon_checkip
  • 0.001s adds_admin_user
  • 0.001s adds_user
  • 0.001s overwrites_admin_password
  • 0.001s modify_attachment_manager
  • 0.001s antivm_vbox_devices
  • 0.001s antivm_vmware_files
  • 0.001s browser_helper_object
  • 0.001s browser_startpage
  • 0.001s suspicious_browser_arguments
  • 0.001s ie_disables_process_tab
  • 0.001s file_credential_store_access
  • 0.001s disables_app_launch
  • 0.001s disables_backups
  • 0.001s disables_crashdumps
  • 0.001s disables_folder_options
  • 0.001s disables_power_options
  • 0.001s disables_run_command
  • 0.001s disables_uac
  • 0.001s disables_wer
  • 0.001s disables_windowsupdate
  • 0.001s folder_enumeration
  • 0.001s mapped_drives_uac
  • 0.001s office_security
  • 0.001s persistence_safeboot
  • 0.001s persistence_shim_database
  • 0.001s reads_password_database
  • 0.001s stealth_hidden_extension
  • 0.001s stealth_hide_notifications
  • 0.001s sysinternals_psexec
  • 0.001s sysinternals_tools
  • 0.001s tampers_etw
  • 0.001s uses_ms_protocol
  • 0.001s suspicious_mpcmdrun_use
Reporting 0.14s
  • 0.143s JsonDump
Signatures
ip: 216.239.34.223
ip: 23.219.86.131
ip: 172.253.118.188
ip: 20.227.97.55
ip: 142.250.195.227
ip: 149.135.84.49
ip: 140.82.113.21
ip: 185.199.109.133
ip: 185.199.111.133
ip: 185.199.108.215
ip: 72.153.5.62
ip: 72.153.5.96
ip: 72.153.5.141
ip: 23.202.166.56
ip: 150.171.109.19
ip: 205.196.6.132
ip: 162.254.195.75
ip: 162.254.195.69
ip: 103.10.125.22
ip: 199.232.211.52
ip: 23.216.106.59
ip: 23.211.129.205
ip: 162.159.128.233
ip: 162.159.130.233
ip: 162.159.135.232
ip: 162.159.133.234
ip: 216.239.36.223
ip: 4.237.22.34
ip: 140.82.114.21
ip: 4.237.22.38
ip: 185.199.108.133
ip: 185.199.110.133
ip: 185.199.109.215
ip: 151.101.193.91
ip: 146.75.119.82
ip: 142.250.195.230
ip: 142.250.207.2
ip: 172.217.25.163
ip: 142.251.42.118
ip: 142.250.195.110
ip: 142.250.183.40
ip: 216.239.34.157
ip: 142.250.195.98
ip: 142.251.222.3
ip: 74.125.130.188
ip: 142.251.42.110
ip: 23.219.86.112
ip: 142.251.222.227
ip: 23.221.49.17
ip: 172.253.118.84
ip: 162.159.128.235
ip: 162.159.133.233
ip: 162.159.135.234
ip: 172.172.255.218
ip: 199.232.215.52
ip: 103.10.125.23
domain: google.com
domain: accounts.google.com
domain: api.steampowered.com
domain: ipv6check-udp.steamserver.net
domain: ipv6check-http.steamserver.net
domain: steamconnecttest.com
domain: www.gstatic.com
domain: easylist-downloads.adblockplus.org
domain: dns.google
domain: play.google.com
domain: encrypted-tbn0.gstatic.com
domain: mtalk.google.com
domain: android.clients.google.com
domain: tunnel.googlezip.net
domain: gateway-us-east1-c.discord.gg
domain: status.discord.com
domain: p2p-syd1.discovery.steamserver.net
domain: cdn.discordapp.com
domain: updates.discord.com
domain: cmp1-sea1.steamserver.net
domain: latency.discord.media
domain: c.pki.goog
domain: disabled.invalid
file: C:\Users\Public\Desktop
file: C:\Users\Public\Desktop\Microsoft Edge.lnk
file: C:\Users\Public\Desktop\Steam.lnk
file: C:\Users\Public\
file: C:\Users\Public\Desktop\Google Chrome.lnk
file: C:\Users\Public\Desktop\%1
file: C:\Users\Public\Desktop\desktop.ini
file: C:\Users\Public\Desktop\
file: C:\Users\Public\desktop.ini
process: updater.exe, PID 32300
regkey: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
regkey: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
mouse_movement: Checks for mouse movement (mouse movement observed in sandbox during sampling).
behavioral_fips_reconnaissance: ["dllhost.exe (PID: 51244) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "OpenWith.exe (PID: 35776) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "dllhost.exe (PID: 36380) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 12464) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "dllhost.exe (PID: 36380) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "SecurityHealthHost.exe (PID: 12464) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 12464) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "OpenWith.exe (PID: 35776) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "dllhost.exe (PID: 8820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "OpenWith.exe (PID: 35776) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "OpenWith.exe (PID: 35776) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "OpenWith.exe (PID: 35776) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 8820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 12464) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "SecurityHealthHost.exe (PID: 12464) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 8820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "dllhost.exe (PID: 51244) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 36380) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 51244) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "dllhost.exe (PID: 36380) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "dllhost.exe (PID: 51244) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "dllhost.exe (PID: 8820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "dllhost.exe (PID: 36380) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "dllhost.exe (PID: 8820) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 51244) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'"]
suspicious_dll_load: Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking
suspicious_dll_load: Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking
thread_resumed: Process explorer.exe with process ID 4484 resumed a thread in another process with the process ID 33484
thread_resumed: Process svchost.exe with process ID 832 resumed a thread in another process with the process ID 22320
thread_resumed: Process services.exe with process ID 676 resumed a thread in another process with the process ID 32300
Creates: updater.exe(55848) Created Named Pipe mojo.GoogleUpdaterSystem
Interacts: updater.exe(32300) writes/reads data to Named Pipe mojo.GoogleUpdaterSystem
Interacts: updater.exe(55848) writes/reads data to Named Pipe mojo.GoogleUpdaterSystem
read_memory: Process explorer.exe with process ID 4484 read from the memory of process handle 0x00002fb8
read_memory: Process updater.exe with process ID 32696 read from the memory of process handle 0x000002d4
read_memory: Process updater.exe with process ID 56176 read from the memory of process handle 0x000002e8
read_memory: Process updater.exe with process ID 56972 read from the memory of process handle 0x00000300
read_memory: Process updater.exe with process ID 57472 read from the memory of process handle 0x000002f0
process: System with pid 4
process: Registry with pid 124
process: smss.exe with pid 384
process: csrss.exe with pid 480
process: wininit.exe with pid 556
process: csrss.exe with pid 576
process: winlogon.exe with pid 656
process: services.exe with pid 676
process: lsass.exe with pid 724
process: svchost.exe with pid 832
process: fontdrvhost.exe with pid 860
process: fontdrvhost.exe with pid 868
process: svchost.exe with pid 948
process: svchost.exe with pid 1004
process: svchost.exe with pid 472
process: svchost.exe with pid 772
process: dwm.exe with pid 1048
process: svchost.exe with pid 1096
process: svchost.exe with pid 1136
process: svchost.exe with pid 1164
process: svchost.exe with pid 1268
process: svchost.exe with pid 1284
process: svchost.exe with pid 1292
process: svchost.exe with pid 1308
process: svchost.exe with pid 1352
process: svchost.exe with pid 1444
process: svchost.exe with pid 1596
process: svchost.exe with pid 1632
process: svchost.exe with pid 1644
process: svchost.exe with pid 1664
process: svchost.exe with pid 1828
process: svchost.exe with pid 1852
process: svchost.exe with pid 1860
process: svchost.exe with pid 1868
process: svchost.exe with pid 1992
process: svchost.exe with pid 2020
process: Memory Compression with pid 2036
process: svchost.exe with pid 2124
process: svchost.exe with pid 2224
process: svchost.exe with pid 2240
process: svchost.exe with pid 2296
process: svchost.exe with pid 2344
process: svchost.exe with pid 2456
process: svchost.exe with pid 2472
process: svchost.exe with pid 2520
process: spoolsv.exe with pid 2696
process: svchost.exe with pid 2724
process: svchost.exe with pid 2772
process: svchost.exe with pid 2876
process: svchost.exe with pid 2896
process: svchost.exe with pid 3012
process: svchost.exe with pid 3020
process: svchost.exe with pid 3040
process: svchost.exe with pid 3048
process: svchost.exe with pid 3056
process: svchost.exe with pid 2292
process: svchost.exe with pid 2820
process: svchost.exe with pid 3396
process: SearchIndexer.exe with pid 3892
process: svchost.exe with pid 3992
process: sihost.exe with pid 3500
process: svchost.exe with pid 3416
process: svchost.exe with pid 4148
process: taskhostw.exe with pid 4240
process: svchost.exe with pid 4300
process: svchost.exe with pid 4380
process: explorer.exe with pid 4484
process: ctfmon.exe with pid 4524
process: svchost.exe with pid 4592
process: svchost.exe with pid 4788
process: svchost.exe with pid 4916
process: svchost.exe with pid 5200
process: svchost.exe with pid 5260
process: svchost.exe with pid 5544
process: StartMenuExperienceHost.exe with pid 5624
process: RuntimeBroker.exe with pid 5688
process: svchost.exe with pid 5800
process: svchost.exe with pid 5892
process: svchost.exe with pid 6008
process: SearchApp.exe with pid 6136
process: RuntimeBroker.exe with pid 5948
process: RuntimeBroker.exe with pid 6436
process: taskhostw.exe with pid 6616
process: smartscreen.exe with pid 6996
process: SecurityHealthSystray.exe with pid 7052
process: SecurityHealthService.exe with pid 7088
process: svchost.exe with pid 6284
process: conhost.exe with pid 3976
process: OneDrive.exe with pid 1104
process: Discord.exe with pid 5128
process: steam.exe with pid 6768
process: steamwebhelper.exe with pid 6400
process: steamservice.exe with pid 6356
process: Discord.exe with pid 6360
process: steamwebhelper.exe with pid 6392
process: Discord.exe with pid 2160
process: steamwebhelper.exe with pid 6512
process: Discord.exe with pid 6504
process: steamwebhelper.exe with pid 7444
process: steamwebhelper.exe with pid 7544
process: Discord.exe with pid 7844
process: steamwebhelper.exe with pid 8100
process: Discord.exe with pid 8340
process: svchost.exe with pid 8108
process: steamwebhelper.exe with pid 3820
process: TextInputHost.exe with pid 8044
process: dllhost.exe with pid 1740
process: svchost.exe with pid 1316
process: svchost.exe with pid 3404
process: SgrmBroker.exe with pid 5364
process: svchost.exe with pid 6640
process: svchost.exe with pid 2580
process: svchost.exe with pid 6188
process: TrustedInstaller.exe with pid 3520
process: TiWorker.exe with pid 5116
process: notepad.exe with pid 8896
process: svchost.exe with pid 8060
process: svchost.exe with pid 6016
process: msedge.exe with pid 10064
process: msedge.exe with pid 9880
process: msedge.exe with pid 11476
process: msedge.exe with pid 11548
process: msedge.exe with pid 11596
process: chrome.exe with pid 12636
process: chrome.exe with pid 12248
process: chrome.exe with pid 13828
process: chrome.exe with pid 13984
process: chrome.exe with pid 14236
process: chrome.exe with pid 15268
process: msedge.exe with pid 16124
process: msedge.exe with pid 16216
process: msedge.exe with pid 16224
process: msedge.exe with pid 16444
process: chrome.exe with pid 16808
process: chrome.exe with pid 18452
process: WmiPrvSE.exe with pid 18964
process: chrome.exe with pid 21712
process: chrome.exe with pid 24460
process: chrome.exe with pid 26524
process: updater.exe with pid 32300
process: updater.exe with pid 32696
process: updater.exe with pid 32864
process: msedge.exe with pid 33752
process: msedge.exe with pid 32896
process: SearchProtocolHost.exe with pid 11280
process: SearchFilterHost.exe with pid 32964
process: msedge.exe with pid 32804
process: SearchProtocolHost.exe with pid 33136
process: svchost.exe with pid 35884
process: chrome.exe with pid 39860
process: chrome.exe with pid 39448
process: chrome.exe with pid 40792
process: chrome.exe with pid 40916
process: chrome.exe with pid 41068
process: chrome.exe with pid 41808
process: chrome.exe with pid 42180
process: chrome.exe with pid 42260
process: chrome.exe with pid 43396
process: WmiPrvSE.exe with pid 45496
process: updater.exe with pid 55848
process: updater.exe with pid 56176
process: updater.exe with pid 55832
process: updater.exe with pid 56408
process: updater.exe with pid 56732
process: updater.exe with pid 56972
process: updater.exe with pid 57320
process: updater.exe with pid 57472
process: updater.exe with pid 57508
process: updater.exe with pid 56236
file: C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001
file: C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001\desktop.ini
file: C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001
file: C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001
file: C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001
file: C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001
file: C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001
file: C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001
mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Data
mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Generation
mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\
mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Data
mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Generation
mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\
mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\
mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Data
unhook: function_name: CommandLineToArgvW, type: restored
ipc_mutex_synchronization: [{'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_16.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_96.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_256.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1280.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1920.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_2560.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_sr.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_wide.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_exif.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_wide_alternate.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_custom_stream.db!dfMaintainer', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!ThumbnailCacheInit', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'mutex_name': 'Global\\G{D8E4A6FE-EA7A-4D20-A8C8-B4628776A101}', 'creator_process': 'updater.exe (PID: 32300)', 'accessor_process': 'updater.exe (PID: 55848)'}, {'mutex_name': '__OMADM_NAMED_MUTEX__', 'creator_process': 'updater.exe (PID: 32300)', 'accessor_process': 'updater.exe (PID: 55848)'}, {'mutex_name': 'Global\\G{D8E4A6FE-EA7A-4D20-A8C8-B4628776A101}', 'creator_process': 'updater.exe (PID: 32300)', 'accessor_process': 'updater.exe (PID: 57320)'}, {'mutex_name': 'Global\\G{D8E4A6FE-EA7A-4D20-A8C8-B4628776A101}', 'creator_process': 'updater.exe (PID: 32300)', 'accessor_process': 'updater.exe (PID: 57508)'}, {'mutex_name': '__OMADM_NAMED_MUTEX__', 'creator_process': 'updater.exe (PID: 32300)', 'accessor_process': 'updater.exe (PID: 57508)'}]
ipc_shared_memory_transfers: [{'shared_memory_name': 'C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'shared_memory_name': 'C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_32.db', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'shared_memory_name': 'C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db', 'creator_process': 'explorer.exe (PID: 4484)', 'accessor_process': 'OpenWith.exe (PID: 35776)'}, {'shared_memory_name': 'C:\\Program Files (x86)\\Google\\GoogleUpdater\\149.0.7814.0\\updater.exe', 'creator_process': 'updater.exe (PID: 56732)', 'accessor_process': 'updater.exe (PID: 57320)'}, {'shared_memory_name': 'C:\\Program Files (x86)\\Google\\GoogleUpdater\\149.0.7814.0\\updater.exe', 'creator_process': 'updater.exe (PID: 56732)', 'accessor_process': 'updater.exe (PID: 57508)'}]
SetWindowsHookExW: Process: explorer.exe(4484)

Seek in progress...

00:00 / 00:00
Hosts
Direct IP Country Name ASN
Y 216.239.34.223 [VT] unknown -
N 23.219.86.131 [VT] unknown -
Y 172.253.118.188 [VT] unknown -
Y 20.227.97.55 [VT] unknown -
N 142.250.195.227 [VT] unknown -
Y 149.135.84.49 [VT] unknown -
Y 140.82.113.21 [VT] unknown -
Y 185.199.109.133 [VT] unknown -
Y 185.199.111.133 [VT] unknown -
Y 185.199.108.215 [VT] unknown -
Y 72.153.5.62 [VT] unknown -
Y 72.153.5.96 [VT] unknown -
Y 72.153.5.141 [VT] unknown -
Y 23.202.166.56 [VT] unknown -
Y 150.171.109.19 [VT] unknown -
N 205.196.6.132 [VT] unknown -
Y 162.254.195.75 [VT] unknown -
Y 162.254.195.69 [VT] unknown -
Y 103.10.125.22 [VT] unknown -
Y 199.232.211.52 [VT] unknown -
N 23.216.106.59 [VT] unknown -
Y 23.211.129.205 [VT] unknown -
N 162.159.128.233 [VT] unknown -
N 162.159.130.233 [VT] unknown -
N 162.159.135.232 [VT] unknown -
N 162.159.133.234 [VT] unknown -
Y 216.239.36.223 [VT] unknown -
Y 4.237.22.34 [VT] unknown -
Y 140.82.114.21 [VT] unknown -
Y 4.237.22.38 [VT] unknown -
Y 185.199.108.133 [VT] unknown -
Y 185.199.110.133 [VT] unknown -
Y 185.199.109.215 [VT] unknown -
Y 151.101.193.91 [VT] unknown -
Y 146.75.119.82 [VT] unknown -
Y 142.250.195.230 [VT] unknown -
Y 142.250.207.2 [VT] unknown -
Y 172.217.25.163 [VT] unknown -
Y 142.251.42.118 [VT] unknown -
N 142.250.195.110 [VT] unknown -
Y 142.250.183.40 [VT] unknown -
N 216.239.34.157 [VT] unknown -
Y 142.250.195.98 [VT] unknown -
Y 142.251.222.3 [VT] unknown -
N 74.125.130.188 [VT] unknown -
N 142.251.42.110 [VT] unknown -
N 23.219.86.112 [VT] unknown -
N 142.251.222.227 [VT] unknown -
N 23.221.49.17 [VT] unknown -
N 172.253.118.84 [VT] unknown -
N 162.159.128.235 [VT] unknown -
N 162.159.133.233 [VT] unknown -
N 162.159.135.234 [VT] unknown -
Y 172.172.255.218 [VT] unknown -
Y 199.232.215.52 [VT] unknown -
Y 103.10.125.23 [VT] unknown -
DNS
Name Response Post-Analysis Lookup
google.com [VT] A 142.250.207.14 [VT] 142.251.42.110 [VT]
accounts.google.com [VT] A 172.253.118.84 [VT] 142.251.12.84 [VT]
api.steampowered.com [VT] A 23.216.106.59 [VT] 23.216.106.59 [VT]
ipv6check-udp.steamserver.net [VT] CNAME udp.ipv6check.akadns.net [VT]
AAAA 2404:3fc0:1:102::670a:7d36 [VT]
AAAA 2404:3fc0:1:102::670a:7d37 [VT]
AAAA 2404:3fc0:1:100::670a:7d06 [VT]
AAAA 2404:3fc0:1:100::42 [VT]
AAAA 2404:3fc0:1:102::670a:7d38 [VT]
CNAME syd.udp.ipv6check.akadns.net [VT]
AAAA 2404:3fc0:1:100::670a:7d08 [VT]
AAAA 2404:3fc0:1:102::670a:7d35 [VT]
AAAA 2404:3fc0:1:100::32 [VT]
ipv6check-http.steamserver.net [VT] CNAME http.ipv6check.akadns.net [VT]
CNAME syd.http.ipv6check.akadns.net [VT]
steamconnecttest.com [VT] A 23.221.49.17 [VT]
A 23.221.49.11 [VT]
23.62.157.117 [VT]
www.gstatic.com [VT] A 142.251.222.227 [VT] 142.250.195.131 [VT]
easylist-downloads.adblockplus.org [VT] CNAME production-filterlist-delivery.easylist-downloads.adblockplus.org.edgesuite.net [VT]
CNAME a1446.dscr.akamai.net [VT]
A 23.219.86.112 [VT]
A 23.219.86.131 [VT]
23.219.86.131 [VT]
dns.google [VT] A 8.8.4.4 [VT]
A 8.8.8.8 [VT]
8.8.8.8 [VT]
play.google.com [VT] A 172.217.25.174 [VT] 142.250.195.110 [VT]
encrypted-tbn0.gstatic.com [VT] A 142.251.42.110 [VT] 142.250.195.174 [VT]
mtalk.google.com [VT] CNAME mobile-gtalk.l.google.com [VT]
A 74.125.130.188 [VT]
172.253.118.188 [VT]
android.clients.google.com [VT] CNAME android.l.google.com [VT]
A 142.251.222.14 [VT]
A 142.250.195.174 [VT]
A 142.250.195.110 [VT]
A 142.250.183.46 [VT]
A 142.250.195.238 [VT]
A 142.250.195.142 [VT]
A 142.251.222.238 [VT]
142.250.195.174 [VT]
tunnel.googlezip.net [VT] A 216.239.34.157 [VT] 216.239.34.157 [VT]
gateway-us-east1-c.discord.gg [VT] A 162.159.130.234 [VT]
A 162.159.134.234 [VT]
A 162.159.135.234 [VT]
A 162.159.133.234 [VT]
A 162.159.136.234 [VT]
162.159.130.234 [VT]
status.discord.com [VT] A 162.159.128.233 [VT]
A 162.159.138.232 [VT]
A 162.159.137.232 [VT]
A 162.159.135.232 [VT]
A 162.159.136.232 [VT]
162.159.136.232 [VT]
p2p-syd1.discovery.steamserver.net [VT] A 103.10.125.24 [VT]
A 103.10.125.42 [VT]
103.10.125.24 [VT]
cdn.discordapp.com [VT] A 162.159.135.233 [VT]
A 162.159.134.233 [VT]
A 162.159.133.233 [VT]
A 162.159.129.233 [VT]
A 162.159.130.233 [VT]
162.159.134.233 [VT]
updates.discord.com [VT] 162.159.128.233 [VT]
cmp1-sea1.steamserver.net [VT] A 205.196.6.132 [VT] 205.196.6.132 [VT]
latency.discord.media [VT] A 162.159.130.235 [VT]
A 162.159.129.235 [VT]
A 162.159.138.234 [VT]
A 162.159.137.234 [VT]
A 162.159.128.235 [VT]
162.159.138.234 [VT]
c.pki.goog [VT] A 142.250.195.227 [VT]
CNAME pki-goog.l.google.com [VT]
142.250.195.163 [VT]
disabled.invalid [VT] NXDOMAIN
Summary
  • \Device\Bam
  • C:\
  • C:\Users\desktop.ini
  • C:\Users
  • C:\Users\admin
  • C:\Users\admin\AppData
  • C:\Users\admin\AppData\Roaming
  • C:\Users\admin\AppData\Roaming\Microsoft\desktop.ini
  • C:\Users\admin\AppData\Roaming\Microsoft
  • C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer
  • C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
  • C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
  • C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
  • C:\Program Files\desktop.ini
  • C:\Windows\apppatch\sysmain.sdb
  • C:\Program Files\
  • C:\Program Files\Google\
  • C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
  • C:\Program Files (x86)\Microsoft\
  • C:\Program Files (x86)\Microsoft\Edge\Application\
  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
  • C:\Program Files (x86)\desktop.ini
  • C:\Users\admin\AppData\Local
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
  • C:\program files (x86)\microsoft\Edge\application\msedge.exe
  • C:\program files (x86)\microsoft\Edge\SystemResources\msedge.exe.mun
  • C:\Users\admin\Desktop\desktop.ini
  • C:\Users\Public\desktop.ini
  • C:\Users\Public
  • C:\Users\Public\Desktop\desktop.ini
  • C:\Windows\System32\SecurityHealthSSO.dll
  • C:\Program Files\Google\Chrome\Application\
  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
  • C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg
  • C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg
  • \??\Volume{528C102F-0000-0000-0000-300300000000}
  • \Device\HarddiskVolume2\\x2d8\x02
  • \??\MountPointManager
  • C:\Windows\System32\services.exe
  • C:\Windows\System32\en-US\services.exe.mui
  • C:\Windows\
  • C:\Windows\System32\
  • C:\Program Files (x86)\Microsoft\Edge\Application
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe\
  • C:\Program Files (x86)\Microsoft\Edge
  • C:\Program Files (x86)\Microsoft\Edge\
  • C:\Program Files (x86)\Microsoft
  • C:\Program Files (x86)
  • C:\Program Files (x86)\
  • C:
  • \??\Volume{528c102f-0000-0000-0000-300300000000}
  • C:\ProgramData\Microsoft\
  • C:\ProgramData\Microsoft\Windows\Start Menu\
  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk\
  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs
  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
  • C:\ProgramData\Microsoft\Windows\Start Menu
  • C:\ProgramData\Microsoft\Windows
  • C:\ProgramData\Microsoft\Windows\
  • C:\ProgramData\Microsoft
  • C:\ProgramData
  • C:\ProgramData\
  • C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms
  • C:\Users\admin\Desktop
  • C:\Users\admin\Desktop\%1
  • C:\Users\Public\Desktop
  • C:\Users\Public\Desktop\%1
  • C:\Windows\System32\twinui.pcshell.dll
  • C:\Windows\explorer.exe
  • C:\Windows\System32\d3d10warp.dll
  • C:\Windows\Fonts\seguisb.ttf
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\resources.pri
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\pris\
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\
  • C:\Windows\rescache\_merged\2716907977\3245838983.pri
  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\pris\resources.en-US.pri
  • C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Burn
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts
  • C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk
  • C:\lpw_albt\dll\TQDMPSoj.dll
  • C:\Windows\System32\ieframe.dll
  • C:\Windows\System32\en-US\UIRibbon.dll.mui
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
  • C:\Users\admin\Downloads
  • C:\Users\admin\Downloads\desktop.ini
  • C:\Users\admin\Documents
  • C:\Users\admin\Documents\desktop.ini
  • C:\Users\admin\Pictures
  • C:\Users\admin\Music
  • C:\Users\admin\Music\desktop.ini
  • C:\Users\admin\Videos
  • C:\Users\admin\Videos\desktop.ini
  • C:\Windows\System32\Microsoft.Windows.Explorer
  • ::\
  • ::\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}
  • C:\Users\admin\OneDrive\
  • C:\Users\admin\
  • C:\Users\
  • C:\Users\admin\OneDrive
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\ThumbCacheToDelete
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
  • C:\Users\admin\Documents\
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
  • C:\Users\admin\Downloads\
  • C:\Windows\System32\en-US\zipfldr.dll.mui
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\IconCacheToDelete
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
  • C:\Windows\System32\zipfldr.dll
  • C:\Windows\System32\SystemResources\zipfldr.dll.mui.mun
  • C:\Windows\SystemResources\zipfldr.dll.mun
  • C:\Windows\System32\imageres.dll
  • C:\Windows\System32\en-US\imageres.dll.mui
  • C:\Windows\System32\SystemResources\imageres.dll.mui.mun
  • C:\Windows\SystemResources\imageres.dll.mun
  • C:\Windows\shell32.dll
  • C:\Windows\System32\shell32.dll
  • ::\{F8278C54-A712-415B-B593-B77A2BE0DDA9}
  • \??\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc\Discord.lnk
  • C:\Program Files\Google\Chrome\Application\chrome.exe
  • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
  • C:\Users\admin\AppData\Local\Discord\app.ico
  • C:\program files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
  • C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\resources.pri
  • C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\_resources\pythonx44.png
  • C:\Program Files
  • C:\Program Files\WindowsApps
  • C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km
  • C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\_resources
  • C:\program files\Google\Chrome\application\chrome.exe
  • C:\program files\Google\Chrome\SystemResources\chrome.exe.mun
  • C:\Users\Public\Desktop\Google Chrome.lnk
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
  • C:\Users\Public\Desktop\Microsoft Edge.lnk
  • C:\Program Files\Google\Chrome\Application\chrome.exe.Config
  • C:\program files (x86)\Steam\bin\cef\SystemResources\steamwebhelper.exe.mun
  • C:\Users\Public\Desktop\
  • C:\Users\Public\
  • C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\_resources\
  • C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\
  • C:\Program Files\WindowsApps\
  • C:\Users\Public\Desktop\Steam.lnk
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe.Config
  • C:\Users\admin\Desktop\Discord.lnk
  • C:\Program Files (x86)\Steam\Steam.exe.Config
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
  • C:\Users\admin\Desktop\WhatsApp Web.url
  • C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\pin10470985910\rawicon.png
  • C:\Users\admin\Desktop\
  • C:\Users\admin\Downloads\Win32.Narilam.zip
  • C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001
  • C:\$Recycle.Bin\S-1-5-21-3968686040-3210279463-847977608-1001\desktop.ini
  • C:\Users\admin\AppData\Local\microsoft\OneDrive\OneDrive.exe
  • C:\Program Files\Internet Explorer\iexplore.exe
  • C:\Windows\System32\mspaint.exe
  • C:\Windows\System32\notepad.exe
  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  • C:\Program Files\Windows NT\Accessories\wordpad.exe
  • C:\Users\admin\Downloads\Win32.Narilam.zip:Zone.Identifier
  • C:\Users\admin\Downloads\Win32.Narilam.zip\
  • C:\Windows\System32\en-US\combase.dll.mui
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Win32.Narilam.lnk
  • C:\Users\admin\AppData\Local\Microsoft\Windows\History\desktop.ini
  • C:\Users\admin\AppData\Local\Microsoft
  • C:\Users\admin\AppData\Local\Microsoft\Windows
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\data.exe_
  • C:\Windows\System32\OpenWith.exe
  • C:\Program Files\Windows Defender\MsMpLics.dll
  • C:\Windows\System32\MsMpLics.dll
  • C:\Windows\System32\gpapi.dll
  • C:\Windows\System32\advapi32.dll
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\data.exe_:Zone.Identifier
  • C:\Users\admin\AppData\Local\Temp
  • C:\Users\admin\AppData\Local\Temp\
  • C:\Users\admin\AppData\Local\
  • C:\Users\admin\AppData\
  • C:\Windows\System32\en-US\OpenWith.exe.mui
  • C:\Windows
  • C:\Windows\System32
  • C:\Users\admin\Favorites
  • C:\Users\admin\Favorites\desktop.ini
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\*
  • C:\Windows\System32\en-US\twext.dll.mui
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini
  • C:\Windows\System32\en-US\sendmail.dll.mui
  • C:\Windows\System32\en-US\fsquirt.exe.mui
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK
  • \??\PIPE\srvsvc
  • C:\Windows\System32\fsquirt.exe
  • C:\Windows\SystemResources\fsquirt.exe.mun
  • C:\Windows\System32\en-US\efscore.dll.mui
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Libraries
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\*.mydocs
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk
  • C:\Windows\System32\WFS.exe
  • C:\Windows\System32\WFSR.dll
  • C:\Windows\System32\en-US\wfsr.dll.mui
  • C:\Windows\System32\SystemResources\WFSR.dll.mui.mun
  • C:\Windows\SystemResources\wfsr.dll.mun
  • C:\Windows\System32\sendmail.dll
  • C:\Windows\SystemResources\sendmail.dll.mun
  • C:\Windows\System32\en-US\MPR.dll.mui
  • \??\PIPE\wkssvc
  • \Device\DfsClient
  • \??\PIPE\DAV RPC SERVICE
  • C:\Users\admin\3D Objects
  • C:\Users\admin\3D Objects\desktop.ini
  • \Device\DeviceApi\Dev\Query
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\desktop.ini
  • C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9
  • C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_en-us_cb612d02732b0fd9\comctl32.dll.mui
  • C:\Users\admin\Downloads\Win32.Narilam
  • C:\Users\admin\Downloads\Win32.Narilam\
  • C:\Users\admin\Downloads\Win32.Narilam\desktop.ini
  • C:\Windows\CHARTV.dll
  • C:\Windows\System32\chartv.dll
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe_
  • C:\Windows\System32\kernel32.dll
  • C:\Program Files\Windows Defender\MpClient.dll
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe_:Zone.Identifier
  • C:\Users\admin\Downloads\Win32.Narilam\Win32.Narilam\
  • C:\Windows\imageres.dll
  • C:\Windows\System32\UIAutomationCore.dll\5
  • C:\Windows\System32\UIAutomationCore.dll
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe.Manifest
  • C:\Users\admin\Downloads\SystemResources\data.exe.mun
  • C:\Users\admin\downloads\win32.narilam\data.exe
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe:Zone.Identifier
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe\
  • C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\resources.pri
  • C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\pris\resources*.pri
  • C:\Windows\rescache\_merged\92721896\3889361505.pri
  • C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\pris\resources.en-US.pri
  • C:\Windows\System32\conhost.exe
  • C:\Windows\System32\Chrome
  • C:\Program Files\Google
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5d696d521de238c3.automaticDestinations-ms
  • C:\Program Files (x86)\Steam\steam.exe
  • C:\program files (x86)\Steam\steam.exe
  • C:\Users\admin\AppData\Local\Discord\Update.exe
  • C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\pin-5035124850\rawicon.png
  • C:\Users\admin\downloads\SystemResources\data.exe.mun
  • C:\Windows\System32\%localappdata%\Packages\Microsoft.Search_8wekyb3d8bbwe\LocalState\ShellFeeds
  • C:\Windows\System32\wbem\WmiPrvSE.exe
  • \??\PhysicalDrive0
  • C:\Windows\System32\SecurityHealthHost.exe
  • C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep
  • C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\S-1-5-18.pckgdep
  • C:\Windows\Globalization\Sorting\sortdefault.nls
  • C:\Windows\SystemResources\USER32.dll.mun
  • C:\Windows\System32\en-US\USER32.dll.mui
  • C:\Windows\System32\rpcss.dll
  • C:\Windows\System32\kernel.appcore.dll
  • \Device\CNG
  • \??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
  • C:\Windows\System32\wmiclnt.dll
  • \??\WMIDataDevice
  • C:\Windows\System32\wbem\en-US\cimwin32.dll.mui
  • C:\Windows\System32\wtsapi32.dll
  • C:\Windows\System32\winsta.dll
  • C:\Windows\System32\samcli.dll
  • C:\Windows\System32\srvcli.dll
  • C:\Windows\System32\netutils.dll
  • C:\Windows\System32\logoncli.dll
  • C:\Windows\System32\schedcli.dll
  • C:\Windows\System32\wkscli.dll
  • C:\Windows\System32\dsrole.dll
  • \??\PIPE\lsarpc
  • C:\Windows\System32\OemInfo.Ini
  • C:\Windows\System32\OemLogo.Bmp
  • C:\Windows\WindowsShell.Manifest
  • C:\Windows\System32\windows.storage.dll
  • C:\Windows\System32\wldp.dll
  • C:\Program Files (x86)\Google\GoogleUpdater
  • C:\Program Files (x86)\Google\GoogleUpdater\updater.log
  • C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
  • C:\Windows\System32\ntmarta.dll
  • C:\Program Files (x86)\Google\GoogleUpdater\
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad
  • \??\pipe\crashpad_32300_EMTWHBIWBXVKXZSQ
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\reports
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\attachments
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\metadata
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\settings.dat
  • C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
  • C:\Windows\System32\omadmapi.dll
  • C:\Windows\System32\powrprof.dll
  • C:\Windows\System32\cryptsp.dll
  • C:\Windows\System32\DMCmnUtils.dll
  • C:\Windows\System32\ncrypt.dll
  • C:\Windows\System32\tbs.dll
  • C:\Windows\System32\umpdc.dll
  • C:\Windows\System32\ntasn1.dll
  • C:\Windows\System32\profapi.dll
  • C:\Windows\sysnative\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead
  • C:\Windows\sysnative\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\*
  • C:\Windows\sysnative\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\*
  • C:\Windows\sysnative\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\*
  • C:\Program Files (x86)\Google\GoogleUpdater\crx_cache
  • C:\Program Files (x86)\Google\GoogleUpdater\crx_cache\*
  • C:\Program Files (x86)\Google\GoogleUpdater\c58d5d25-54e2-4381-8733-333b06c231dd.tmp
  • C:\Program Files (x86)\Google
  • C:\Program Files (x86)\Google\GoogleUpdater\88ff190d-24a5-42ae-973c-2f3f32734560.tmp
  • C:\Windows\System32\usermgrcli.dll
  • C:\Windows\System32\propsys.dll
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Caches
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db
  • C:\Windows\SysWOW64\propsys.dll
  • C:\Windows\System32\dui70.dll
  • C:\Windows\System32\duser.dll
  • C:\Windows\System32\BCP47mrm.dll
  • C:\Windows\System32\d3d11.dll
  • C:\Windows\System32\dxgi.dll
  • C:\Windows\System32\DXCore.dll
  • C:\Windows\System32\D3D10Warp.dll
  • C:\Windows\System32\oleacc.dll
  • C:\Windows\System32\en-US\OLEACCRC.DLL.mui
  • C:\Windows\System32\edputil.dll
  • C:\Windows\System32\WindowsCodecs.dll
  • C:\Users\admin\AppData\Local\IconCache.db
  • C:\program files\internet explorer\iexplore.exe
  • C:\program files\internet explorer\en-US\iexplore.exe.mui
  • C:\Program Files\Internet Explorer\SystemResources\iexplore.exe.mui.mun
  • C:\program files\SystemResources\iexplore.exe.mun
  • C:\Windows\System32\policymanager.dll
  • C:\Windows\System32\msvcp110_win.dll
  • C:\Windows\System32\en-US\mspaint.exe.mui
  • C:\Windows\SystemResources\mspaint.exe.mun
  • C:\Windows\System32\en-US\NOTEPAD.EXE.mui
  • C:\Windows\SystemResources\notepad.exe.mun
  • C:\Windows\System32\en-US\wmploc.dll.mui
  • C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui
  • C:\program files (x86)\windows media player\wmplayer.exe
  • C:\program files (x86)\windows media player\en-US\wmplayer.exe.mui
  • C:\Program Files (x86)\Windows Media Player\SystemResources\wmplayer.exe.mui.mun
  • C:\program files (x86)\SystemResources\wmplayer.exe.mun
  • C:\Windows\System32\en-US\SHELL32.dll.mui
  • C:\Program Files\Windows NT\Accessories\en-US\WORDPAD.EXE.mui
  • C:\program files\windows nt\accessories\wordpad.exe
  • C:\program files\windows nt\SystemResources\wordpad.exe.mun
  • C:\Windows\System32\apphelp.dll
  • C:\Windows\System32\windows.staterepositorycore.dll
  • C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-3968686040-3210279463-847977608-1001-MergedResources-1.pri
  • C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\resources.pri
  • C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri
  • C:\Windows\System32\sxs.dll
  • C:\Windows\System32\TextShaping.dll
  • C:\Windows\Fonts\segoeui.ttf
  • C:\Windows\Fonts\seguisym.ttf
  • C:\Windows\Fonts\segmdl2.ttf
  • C:\Windows\System32\en-US\PROPSYS.dll.mui
  • C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep
  • C:\Windows\System32\urlmon.dll
  • C:\Windows\System32\iertutil.dll
  • C:\Windows\system32
  • C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-100.png
  • C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe
  • C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets
  • C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles
  • C:\Users\admin\Pictures\desktop.ini
  • C:\Users\admin\OneDrive\desktop.ini
  • C:\Program Files\Google\Chrome\ChromeRecovery
  • C:\Program Files\Google\Chrome\Application\148.0.7778.217\elevation_service.exe
  • C:\Windows\System32\stdole2.tlb
  • C:\Program Files\Google\Chrome\Application\148.0.7778.217\DPAPI.dll
  • C:\Windows\System32\dpapi.dll
  • \??\pipe\crashpad_55848_BVPBIAFPXABPJKFO
  • C:\Program Files (x86)\Google\GoogleUpdater\ca421c60-8f17-40ad-a01c-15790365d31c.tmp
  • C:\Program Files (x86)\Google\GoogleUpdater\7b561a3e-8102-4a63-9d4a-a3edf0b7f0ef.tmp
  • \??\pipe\crashpad_55832_OKFVRERPWOBAFKID
  • C:\Program Files (x86)\Google\GoogleUpdater\*
  • \??\pipe\crashpad_56732_ZXWPRJOJRVQEJZQM
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe\5
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe
  • C:\Windows\SysWOW64\stdole2.tlb
  • \??\pipe\crashpad_57320_YGEBQVOTKCJJEKYD
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\prefs.json
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe\4
  • \??\pipe\crashpad_57508_OHACKONKBGQNSKBT
  • C:\Program Files (x86)\Google\Update\*
  • C:\Windows\SystemTemp
  • C:\Windows\SystemTemp\*GoogleUpdater_chrome_url_fetcher_*
  • C:\Windows\SystemTemp\*GoogleUpdater_chrome_Unpacker_BeginUnzipping*
  • C:\Windows\SystemTemp\*GoogleUpdater_chrome_BITS_*
  • C:\Program Files (x86)\Google\GoogleUpdater\8864a617-d13e-4ba5-8384-d9817f27bf3f.tmp
  • C:\Program Files (x86)\Google\GoogleUpdater\84dcf501-3a5f-47f8-9319-0844e4f33e43.tmp
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
  • C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Win32.Narilam.lnk
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\data.exe_
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\data.exe_:Zone.Identifier
  • \??\PIPE\srvsvc
  • \??\PIPE\wkssvc
  • \??\PIPE\DAV RPC SERVICE
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe_
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe_:Zone.Identifier
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
  • C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms
  • \??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
  • \??\WMIDataDevice
  • \??\PIPE\lsarpc
  • C:\Program Files (x86)\Google\GoogleUpdater\updater.log
  • C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl
  • \??\pipe\crashpad_32300_EMTWHBIWBXVKXZSQ
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\metadata
  • C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad\settings.dat
  • C:\Program Files (x86)\Google\GoogleUpdater\c58d5d25-54e2-4381-8733-333b06c231dd.tmp
  • C:\Program Files (x86)\Google\GoogleUpdater\88ff190d-24a5-42ae-973c-2f3f32734560.tmp
  • C:\Program Files (x86)\Google\GoogleUpdater\prefs.json
  • \??\pipe\crashpad_55848_BVPBIAFPXABPJKFO
  • C:\Program Files (x86)\Google\GoogleUpdater\ca421c60-8f17-40ad-a01c-15790365d31c.tmp
  • C:\Program Files (x86)\Google\GoogleUpdater\7b561a3e-8102-4a63-9d4a-a3edf0b7f0ef.tmp
  • \??\pipe\crashpad_55832_OKFVRERPWOBAFKID
  • \??\pipe\crashpad_56732_ZXWPRJOJRVQEJZQM
  • \??\pipe\crashpad_57320_YGEBQVOTKCJJEKYD
  • \??\pipe\crashpad_57508_OHACKONKBGQNSKBT
  • C:\Windows\SystemTemp
  • C:\Program Files (x86)\Google\GoogleUpdater\8864a617-d13e-4ba5-8384-d9817f27bf3f.tmp
  • C:\Program Files (x86)\Google\GoogleUpdater\84dcf501-3a5f-47f8-9319-0844e4f33e43.tmp
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\data.exe_
  • C:\Users\admin\AppData\Local\Temp\38c651f5-fb17-48c7-adc7-ec231b0d4b23_Win32.Narilam.zip.b23\
  • C:\Users\admin\Downloads\Win32.Narilam\data.exe_
  • C:\Program Files (x86)\Google\GoogleUpdater\88ff190d-24a5-42ae-973c-2f3f32734560.tmp
  • C:\Program Files (x86)\Google\GoogleUpdater\7b561a3e-8102-4a63-9d4a-a3edf0b7f0ef.tmp
  • C:\Program Files (x86)\Google\GoogleUpdater\84dcf501-3a5f-47f8-9319-0844e4f33e43.tmp
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler
  • HKEY_CURRENT_USER\Software\Classes
  • HKEY_CURRENT_USER\Software\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\Forward
  • HKEY_CURRENT_USER\Software\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\TypeLib\Version
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{679F85CB-0220-4080-B29B-5540CC05AAB6}
  • HKEY_CLASSES_ROOT\CLSID\{679F85CB-0220-4080-B29B-5540CC05AAB6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.AppUserModel.ID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\Namespace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\MonitorRegistry
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).x
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).y
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1920x1080x96(1).x
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1920x1080x96(1).y
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).left
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).top
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).right
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).bottom
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\IEAK
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\IEAK
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HubMode
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{679F85CB-0220-4080-B29B-5540CC05AAB6}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RetailDemo\OobeWrite
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RetailDemo\OobeWrite\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Input
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
  • HKEY_LOCAL_MACHINE\Software\Microsoft\DirectUI\DynamicScaling
  • HKEY_LOCAL_MACHINE\Software\Microsoft\DirectUI
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\Extensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\Extensions\DragDropExtension
  • HKEY_CURRENT_USER\Control Panel\Desktop
  • HKEY_CURRENT_USER\Control Panel\Desktop\CaretWidth
  • HKEY_CURRENT_USER\Control Panel\Desktop\CursorBlinkRate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\FolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\FolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\SniffedFolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\Desktop
  • HKEY_CLASSES_ROOT\CLSID\{7EB5FBE4-2100-49E6-8593-17E130122F91}\Instance
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AlwaysShowMenus
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AlwaysShowMenus
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\MenuUserExpanded
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\WCOSNavigationBaselineAllowedlist
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AllowedNavigation
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AllowedNavigation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ExePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\CommandLine
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\IdentityType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ActivatableClasses
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ServerType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\AppId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\Identity
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ServiceName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ExplicitPsmActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\CustomAttributes
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InprocHandler
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MicrosoftAccount
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\Value
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\Device\Accounts
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\Value
  • HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\AttributeMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\AttributeValue
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ShowAsDisabledIfHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\AttributeMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\MultiSelectModel
  • HKEY_CLASSES_ROOT\CLSID\{3756E7F5-E514-4776-A32B-EB24BC1EFE7A}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ShowAsDisabledIfHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\MaxDownloadFileSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Ribbon
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon\QatItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\ExplorerCommandHandler
  • HKEY_CLASSES_ROOT\CLSID\{0DBD7044-8EA5-4573-A924-FE8565CCE18F}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\MultiSelectModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\ExplorerCommandHandler
  • HKEY_CLASSES_ROOT\CLSID\{1CC6B704-D0F5-4DC3-A521-13620D89E8BC}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ribbondelete
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\ExplorerCommandHandler
  • HKEY_CLASSES_ROOT\CLSID\{CC89BA65-661C-494A-85C0-5D697DFEB30C}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\AttributeMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\AttributeValue
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ShowAsDisabledIfHidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon\MinimizedStateTabletModeOff
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\MUIVerb
  • HKEY_CLASSES_ROOT\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  • HKEY_CLASSES_ROOT\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.playto
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.AddMediaServer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.BitLocker
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.HistoryVaultRestore
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonSync.WorkOfflineOnline
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.CleanUp
  • HKEY_CURRENT_USER
  • HKEY_CURRENT_USER\Control Panel\International\Geo
  • HKEY_CURRENT_USER\Control Panel\International\Geo\Nation
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\DeviceAccess\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\ActivePolicyCode
  • HKEY_CURRENT_USER\Software\Microsoft\OneDrive
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\OneDriveFRECompleted
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\FullRowSelect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\FullRowSelect
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ServerAdminUI
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{679F85CB-0220-4080-B29B-5540CC05AAB6}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{679F85CB-0220-4080-B29B-5540CC05AAB6}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupCollapseState
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InprocHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\PrefetchAbove
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\PrefetchAbove
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\PrefetchBelow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\PrefetchBelow
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
  • HKEY_CURRENT_USER\Software\Classes\DelegateFolders
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\Namespace
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\Namespace\DelegateFolders
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\Namespace\DelegateFolders
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\HomeFolderDesktop\Namespace
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\HomeFolderDesktop\Namespace\DelegateFolders
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowFrequent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowFrequent
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowRecent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowRecent
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Start\HideRecentJumplists
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\grouppolicypath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\grouppolicyismultisz
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\grouppolicymultiszSeparatorChar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\Value
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\S-1-5-21-3968686040-3210279463-847977608-1001\Start
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\Device\Start
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowEncryptCompressedColor
  • HKEY_CLASSES_ROOT\CLSID\{D58960BA-2EF3-4910-9E34-C911B1710180}\Instance
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\TravelLog
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\WCOSEnumerationBaselineAllowedlist
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\AllowedEnumeration
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AllowedEnumeration
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\DelegateFolders\StorageDelegateSuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\DelegateFolders\StorageDelegate
  • HKEY_CLASSES_ROOT\CLSID\{BDE9EE7C-329F-4FCF-BA7A-F8C6E9B4579D}\Instance
  • HKEY_CLASSES_ROOT\CLSID\{62112AA1-EBE4-11CF-A5FB-0020AFE7292D}\Instance
  • HKEY_CLASSES_ROOT\CLSID\{C206F324-BB45-4765-93FF-3BCA7306FF2E}\Instance
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NavPaneShowAllCloudStates
  • HKEY_CLASSES_ROOT\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\
  • HKEY_CLASSES_ROOT\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Generation
  • HKEY_CLASSES_ROOT\CLSID\{A8CDFF1C-4878-43BE-B5FD-F8091C1C60D0}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A8CDFF1C-4878-43BE-B5FD-F8091C1C60D0}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{A8CDFF1C-4878-43BE-B5FD-F8091C1C60D0}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\
  • HKEY_CLASSES_ROOT\CLSID\{3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\GlobalSettings\ProperTreeModuleInner\ProperTreeModuleInner
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowStatusBar
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\GlobalSettings\Sizer
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\BannerSettings
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSyncProviderNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSyncProviderNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.PropList.StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{26DC287C-6E3D-4BD3-B2B0-6A26BA2E346D} 4
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\LaunchTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\LaunchTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.LibraryLocationsCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{908696C7-8F87-44F2-80ED-A8C1C6894575} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.Sync.ItemState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{7BD5533E-AF15-44DB-B8C8-BD6624E1D032} 25
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{679F85CB-0220-4080-B29B-5540CC05AAB6}
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchProviders\
  • HKEY_CLASSES_ROOT\CLSID\{679F85CB-0220-4080-B29B-5540CC05AAB6}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\ShellFolder\DisableContextualTabset
  • HKEY_CLASSES_ROOT\Folder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\tabsets
  • HKEY_CURRENT_USER\Software\Classes\Folder\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 9
  • HKEY_CLASSES_ROOT\CLSID\{1CF1260C-4DD0-4EBB-811F-33C572699FDE}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance
  • HKEY_CLASSES_ROOT\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1CF1260C-4DD0-4EBB-811F-33C572699FDE}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1CF1260C-4DD0-4EBB-811F-33C572699FDE}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowPidInTitle
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag\BaseFolderId
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\RDVirtualizationPool
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3968686040-3210279463-847977608-1001\fdeploy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
  • HKEY_CLASSES_ROOT\CLSID\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}
  • HKEY_CLASSES_ROOT\CLSID\{A0953C92-50DC-43BF-BE83-3742FED03C9C}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\HelpTopic
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A0953C92-50DC-43BF-BE83-3742FED03C9C}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{A0953C92-50DC-43BF-BE83-3742FED03C9C}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\DefaultIcon\OpenIcon
  • HKEY_CLASSES_ROOT\CLSID\{AD974AE2-E292-4083-A280-0342D68DAF55}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag\BaseFolderId
  • HKEY_CLASSES_ROOT\CLSID\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}
  • HKEY_CLASSES_ROOT\CLSID\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane\ExpandedState
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{F86FA3AB-70D2-4FC7-9C99-FCBF05467F3A}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager
  • HKEY_CLASSES_ROOT\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\Instance
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
  • HKEY_CURRENT_USER\Software\Microsoft\CTF\DirectSwitchHotkeys
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders\
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\DelegateFolders
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\InputMethod\Settings\JPN
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\ADMXMetadataDevice
  • HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\Device\TextInput
  • HKEY_CLASSES_ROOT\CLSID\{08D5BFBF-FBCA-4322-9F70-CA9F66F8ED6A}\Instance
  • HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{5D76B67F-9B3D-44BB-B6AE-25DA4F638A67} 2
  • HKEY_CLASSES_ROOT\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\{5D76B67F-9B3D-44BB-B6AE-25DA4F638A67} 2
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000090046
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\MonitorRegistry
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders\StorageDelegateSuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52205fd8-5dfb-447d-801a-d0b52f2e83e1}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{56AD4C5D-B908-4F85-8FF1-7940C29B3BCF}\Instance
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYFRFFVBA
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{374DE290-123F-4565-9164-39C4925E467B}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\DWM\ColorPrevalence
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{A8CDFF1C-4878-43BE-B5FD-F8091C1C60D0}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Feeds
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\HeadlinesOnboardingComplete
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\ShellFeedsTaskbarViewMode
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\IsFeedsAvailable
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell\TabletMode
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\ShellFeedsTaskbarContentUpdateMode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\{5D76B67F-9B3D-44BB-B6AE-25DA4F638A67} 2
  • HKEY_CLASSES_ROOT\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{031E4825-7B94-4DC3-B131-E946B44C8DD5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SortOrderIndex
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{4336A54D-038B-4685-AB02-99BB52D3FB8B}
  • HKEY_CLASSES_ROOT\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
  • HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{450D8FBA-AD25-11D0-98A8-0800361B1103}
  • HKEY_CLASSES_ROOT\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SortOrderIndex
  • HKEY_CLASSES_ROOT\CLSID\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{5B934B42-522B-4C34-BBFE-37A3EF7B9C90}
  • HKEY_CLASSES_ROOT\CLSID\{64693913-1C21-4F30-A98F-4E52906D3B56}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64693913-1c21-4f30-a98f-4e52906d3b56}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{64693913-1C21-4F30-A98F-4E52906D3B56}
  • HKEY_CLASSES_ROOT\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89D83576-6BD1-4c86-9454-BEB04E94C819}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{89D83576-6BD1-4C86-9454-BEB04E94C819}
  • HKEY_CLASSES_ROOT\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}
  • HKEY_CLASSES_ROOT\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9343812e-1c37-4a49-a12e-4b2d810d956b}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{9343812E-1C37-4A49-A12E-4B2D810D956B}
  • HKEY_CLASSES_ROOT\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}
  • HKEY_CLASSES_ROOT\CLSID\{A00EE528-EBD9-48B8-944A-8942113D46AC}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a00ee528-ebd9-48b8-944a-8942113d46ac}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{A00EE528-EBD9-48B8-944A-8942113D46AC}
  • HKEY_CLASSES_ROOT\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{daf95313-e44d-46af-be1b-cbacea2c3065}\SortOrderIndex
  • HKEY_CLASSES_ROOT\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e345f35f-9397-435c-8f95-4e922c26259e}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{E345F35F-9397-435C-8F95-4E922C26259E}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{F8278C54-A712-415B-B593-B77A2BE0DDA9}
  • HKEY_CLASSES_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{A0953C92-50DC-43BF-BE83-3742FED03C9C}
  • HKEY_CLASSES_ROOT\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\DescriptionID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\HelpTopic
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\HideNonRemovableDrives
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\UseRemovableStorageRegPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\UseRemovableDrivesRegPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\NoDelegateSearchRoot
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\HideNonStorageServiceMountedDrives
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\ForceAllDrivesRemovable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\ShowAllOpticalDevices
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\RemovableDrives\DelegateFolders
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\MyComputer\RemovableDrives
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\MyComputer\RemovableDrives\DelegateFolders
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NeverShowDrivesMask
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideDrivesWithNoMedia
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\Desktop\NameSpace\NameCustomizations
  • HKEY_CLASSES_ROOT\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\(Default)
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\CommonTriggerRegistrations\UserIdle\Show
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Mobility
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Mobility\LastResumeOnPCTime
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Mobility\LastResumeOnPCInteractionTime
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\OpenIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{4234D49B-0245-4DF3-B780-3893943456E1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\HelpTopic
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{1CF1260C-4DD0-4EBB-811F-33C572699FDE}
  • HKEY_CLASSES_ROOT\CLSID\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\LocalizedString
  • HKEY_CURRENT_USER\Software\Classes\Microsoft.Windows.Explorer
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon\OpenIcon
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\LocalizedString
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon\OpenIcon
  • HKEY_CLASSES_ROOT\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\LocalizedString
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.Home.PropList.Sort
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA}
  • HKEY_CLASSES_ROOT\CLSID\{374DE290-123F-4565-9164-39C4925E467B}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\DefaultIcon\OpenIcon
  • HKEY_CLASSES_ROOT\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\DefaultIcon\OpenIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag
  • HKEY_CLASSES_ROOT\CLSID\{A8CDFF1C-4878-43BE-B5FD-F8091C1C60D0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\DefaultIcon\OpenIcon
  • HKEY_CLASSES_ROOT\CLSID\{3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\DefaultIcon\OpenIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\DefaultIcon
  • HKEY_CLASSES_ROOT\CLSID\{1CF1260C-4DD0-4EBB-811F-33C572699FDE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\DefaultIcon\OpenIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\DefaultIcon\OpenIcon
  • HKEY_CLASSES_ROOT\CLSID\{53A01E9D-61CC-4CB0-83B1-31BC8DF63156}\Instance
  • HKEY_CLASSES_ROOT\CLSID\{0C0B25F5-E762-4004-96CD-00FFC1ECB5BF}\Instance
  • HKEY_CLASSES_ROOT\CLSID\{5B389765-EDC1-4ADF-9812-1C8A83175892}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_CLASSES_ROOT\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\windows.storage.dll,-9216
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag\BaseFolderId
  • HKEY_CLASSES_ROOT\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{088E3905-0323-4B02-9826-5D99428E115F}
  • HKEY_CLASSES_ROOT\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\System.StorageProviderUIStatus
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{088E3905-0323-4B02-9826-5D99428E115F}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag\BaseFolderId
  • HKEY_CLASSES_ROOT\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\SortOrderIndex
  • HKEY_CLASSES_ROOT\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{D3162B92-9365-467A-956B-92703ACA08AF}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag\BaseFolderId
  • HKEY_CLASSES_ROOT\CLSID\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}
  • HKEY_CLASSES_ROOT\CLSID\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{24AD3AD4-A569-4530-98E1-AB02F9417AA8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_CLASSES_ROOT\CLSID\{3DFDF296-DBEC-4FB4-81D1-6A3438BCF4DE}\Instance
  • HKEY_CLASSES_ROOT\CLSID\{A0953C92-50DC-43BF-BE83-3742FED03C9C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{D3162B92-9365-467A-956B-92703ACA08AF}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\System.Volume.IsRoot
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\{9B174B35-40FF-11D2-A27E-00C04FC30871} 10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.StatusIcons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{7A55582B-BD8C-4475-B94C-B87A388A7899} 100
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ThumbnailCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HomeGroupProvider\ServiceData
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.Rkcybere
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\System.Volume.BitLockerProtection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\{2D15A9A1-A556-4189-91AD-027458F11A07} 1717
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}\Instance\InitPropertyBag
  • HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.current
  • HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\Value
  • HKEY_CURRENT_USER\Software\Microsoft\Input\TSF\Tsf3Override\{03b5835f-f03c-411b-9ce2-aa23e1171e36}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Size
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\FolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\Inherit
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\Inherit
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Shell\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Shell\Bags\AllFolders\Shell
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\KnownFolderDerivedFolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupCollapseState
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Inherit
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Inherit
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{885A186E-A440-4ADA-812B-DB871B942259}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{885A186E-A440-4ADA-812B-DB871B942259}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Version
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\PropertyBag\NoCustomize
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.zip
  • HKEY_CLASSES_ROOT\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\UserChoice
  • HKEY_CLASSES_ROOT\.zip\OpenWithProgids
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids
  • HKEY_LOCAL_MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.zip
  • HKEY_CLASSES_ROOT\CompressedFolder
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\CurVer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\CurVer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\IconHandler
  • HKEY_CLASSES_ROOT\SystemFileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\ShellEx\IconHandler
  • HKEY_CLASSES_ROOT\SystemFileAssociations\compressed
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Clsid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\CLSID\(Default)
  • HKEY_CLASSES_ROOT\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\Implemented Categories\{00021490-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NeverShowExt
  • HKEY_CURRENT_USER\Software\Classes\.zip\OpenWithProgids
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\Clsid
  • HKEY_CLASSES_ROOT\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\FolderValueFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsParseDisplayName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\MapNetDriveVerbs
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\QueryForInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\EnableThumbnails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\NoDefaultToFS
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\ParseDisplayNameNeedsURL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\BlockNewFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\NoInitRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\SafeRootForMTA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsSendToTarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\NoLocalizedNameInTarget
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\ShellFolder
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\ShellFolder
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\GlobalSettings\ProperTreeModuleInner
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\GlobalSettings\DetailsContainer
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{D3162B92-9365-467A-956B-92703ACA08AF}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag
  • HKEY_CLASSES_ROOT\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\ShellFolder\DisableContextualTabset
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InprocHandler
  • HKEY_CLASSES_ROOT\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32\InprocServer32
  • HKEY_CLASSES_ROOT\Directory
  • HKEY_CURRENT_USER\Software\Classes\Directory\
  • HKEY_CLASSES_ROOT\AllFilesystemObjects
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\tabsets
  • HKEY_CURRENT_USER\Software\Classes\Directory\tabsets
  • HKEY_LOCAL_MACHINE\Software\Classes\Directory\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\tabsets
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 9
  • HKEY_CLASSES_ROOT\Directory\shellex\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.zip
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.zip
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\ShellEx\PropertyHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\PropertyHandler
  • HKEY_CURRENT_USER\Software\Classes\.zip\ShellEx\PropertyHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\ShellEx\PropertyHandler
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.zip\ShellEx\PropertyHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\ShellEx\PropertyHandler
  • HKEY_CURRENT_USER\Software\Classes\Folder\ShellEx\PropertyHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\PropertyHandler
  • HKEY_CLASSES_ROOT\*
  • HKEY_CURRENT_USER\Software\Classes\*\ShellEx\PropertyHandler
  • HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\PropertyHandler
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\PropertyHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\PropertyHandler
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\FirstEntry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\LastEntry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\2026
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\2007
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\2027
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\FriendlyTypeName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\Value
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\Device\DataProtection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.PropList.StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{26DC287C-6E3D-4BD3-B2B0-6A26BA2E346D} 4
  • HKEY_CURRENT_USER\Software\Classes\Directory\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.StatusIcons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{7A55582B-BD8C-4475-B94C-B87A388A7899} 100
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\DesktopIniPropertyMap
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DesktopIniPropertyMap\PropertySetStorage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DesktopIniPropertyMap\PropertySetStorage\{7A55582B-BD8C-4475-B94C-B87A388A7899}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.PropList.StatusIcons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{C9944A21-A406-48FE-8225-AEC7E24C211B} 16
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.SharingStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{EF884C5B-2BFE-41BB-AAE5-76EEDF4F9902} 300
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.SharedWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{EF884C5B-2BFE-41BB-AAE5-76EEDF4F9902} 200
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.OfflineStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{6D24888F-4718-4BDA-AFED-EA0FB4386CD8} 100
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.LibraryLocationsCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{908696C7-8F87-44F2-80ED-A8C1C6894575} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DesktopIniPropertyMap\PropertySetStorage\{908696C7-8F87-44F2-80ED-A8C1C6894575}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.Sync.ItemState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{7BD5533E-AF15-44DB-B8C8-BD6624E1D032} 25
  • HKEY_CLASSES_ROOT\CLSID\{6BC752F7-9721-49F8-873B-9FECB6215DE3}\Instance
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\OSSyncStatusProviders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\.zip
  • HKEY_CURRENT_USER\Software\Classes\Directory\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\Software\Classes\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\Directory\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
  • HKEY_CURRENT_USER\Software\Classes\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Classes\Directory\Clsid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\Clsid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\Clsid
  • HKEY_CURRENT_USER\Software\Classes\Directory\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\Directory\AlwaysShowExt
  • HKEY_CURRENT_USER\Software\Classes\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\GlobalAssocChangedCounter
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\GlobalAssocChangedCounter
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{11659A23-5884-4D1B-9CF6-67D6F4F90B36}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\DefaultIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\DefaultIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\microsoft-edge\URL Protocol
  • HKEY_CURRENT_USER\Software\RegisteredApplications
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXen1zmpxj5y8hccxeamgss1pv44xm9s4c
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXkm0p48j6vxa6sy1kzptp6c0skbrxk2xn
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX3302e372sk11smx9tbq60y86ggqfxvy1
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXm3ssa619v4xrhhddxj7maks7afa875sn
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX5vch6tap2vdqjatpmmze527d6gbw9snf
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXgtd8h4tnyrbh96yaxwt6z3pgwz63tg4e
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXxygf2kzevwed6xtc0tnvag57321m0gf7
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXqbwwf452mex80ks5a1qcgdbx4q1q68ps
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX9a5b64vqrc7t295d0avsvkqjbcdcasb7
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXbpvt3ybb9z170k77w6aygrkk3dpbx7mb
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXm09rke5hc4nvhb8wjwhv1zafzzstx1y2
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXh02wydnwxxfzrncb6xbx9y365rwsqrj0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX17g64qt4xqrmcgsbg0rt0r5pz91807cc
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXtkxgtha8255pnxrsbkg89t4f1wpmvger
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXpvggj8wtagvqq1trs4afp513ydqb63tt
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXkz68dp558dnjsc1ycr8f283vxqwzxstp
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXgvfc47vdahvb6zamkja2gyckzmx6q5xs
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX6718mn68jej1kxz691e99c70v5b37pv0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\Desktop\NameSpace
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\Desktop\NameSpace\DelegateFolders
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXpk3ftb6c358840b76bevz745rj5p9nkd
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX965kgq2vdagyyvkr19xz1tznhv8zk22p
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXh7gch3awtd2ekrcke8ktgxdew9dpq4gg
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXpb2rprh78ppcr2kwetykjxfzjgj219r0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXg6bgebytw9271kpwkyxm8t8s3zar0kg4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders\StorageDelegate
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX16s5agjg9z17wcy7srnx53ggb3bg1kkk
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXk1xfdrxj0frfne472rb7b2khxycqzx5x
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXwbzyd2zvdcrg5n0kqs9656aedk69jvdn
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX5xzkhwabag7tnvestq8sq2mr9aj8zar1
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX62tmns3r7mfjj7zmt4812e41tngg8jjg
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX8ar856dxr16fbc5qq5wfv0wr3pbkbt6b
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXnzea40qecbxvx5d82k30pzmnkk9x1yzc
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXmsxme3p13bxdhe981xm4mhe85549r803
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX4ztg00pywtgkv3d1109g9bfffry8qgc4
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXxevv7w4echwe3sagycz14jet3p1yv42y
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX4eeje680ymkh4aq4e16r99mv706ssk59
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX0ckx7rcw2py1jn1dhe11tgddg9cz4f8q
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXhs9ftp6gpj2rfhftf1t60n8ar0c0zgph
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX8tw43gpb5qj1wsq9bkhecdqbx9g4rdpc
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXnxybh9gej9ah7k6wcw3g39f2ssczetzq
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXxrp0f9h19m81p2jh0836h680jhs01vtm
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXcb3213yx90n9xkdt47ajfwnh99hwn4nq
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXak90wawbmx6n9rc79y67hg6myh1tm6ky
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\URLAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04731B67-D933-450a-90E6-4ACD2E9408FE}\SortOrderIndex
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXcdgbg1vz5fyrfg44thjqv4g8fzdzs3cw
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXsj6x275z6n8r00d0ya2a1q5ht4b2nvf9
  • HKEY_CLASSES_ROOT\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CLASSES_ROOT\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}
  • HKEY_LOCAL_MACHINE\Software\RegisteredApplications
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\File Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\UrlAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Address Book
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Disc Image Burner
  • HKEY_LOCAL_MACHINE\Software\Microsoft\IsoBurn\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Search
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\UrlAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Notepad
  • HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\Notepad\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Wordpad
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\URLAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\Software\Clients\StartMenuInternet\Microsoft Edge\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\microsoft-edge
  • HKEY_LOCAL_MACHINE\Software\Classes\microsoft-edge
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\microsoft-edge\UserChoice
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\microsoft-edge\UserChoice\ProgId
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\microsoft-edge\UserChoice\Hash
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\microsoft-edge\
  • HKEY_CLASSES_ROOT\MSEdgeHTM
  • HKEY_CURRENT_USER\Software\Classes\MSEdgeHTM\CurVer
  • HKEY_CLASSES_ROOT\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\CurVer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationName
  • HKEY_LOCAL_MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\microsoft-edge
  • HKEY_CLASSES_ROOT\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.lnk
  • HKEY_CLASSES_ROOT\.lnk
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\HomeGroup\TestHooks\UIStatusCacheDebugOverride
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}
  • HKEY_CLASSES_ROOT\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}
  • HKEY_CLASSES_ROOT\CLSID\{EDC978D6-4D53-4B2F-A265-5805674BE568}
  • HKEY_CLASSES_ROOT\CLSID\{F8278C54-A712-415B-B593-B77A2BE0DDA9}
  • HKEY_LOCAL_MACHINE\Software\Classes\SystemFileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\*
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\Software\Classes\.lnk
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\(Default)
  • HKEY_CLASSES_ROOT\lnkfile
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\CurVer
  • HKEY_LOCAL_MACHINE\Software\Classes\lnkfile\CurVer
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\RemovableDrives
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\DocObject
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\DocObject
  • HKEY_CLASSES_ROOT\SystemFileAssociations\.lnk
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\CLSID
  • HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}\Implemented Categories\{00021490-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\AlwaysShowExt
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\NeverShowExt
  • HKEY_LOCAL_MACHINE\Software\Classes\lnkfile\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\shellex\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\(Default)
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url
  • HKEY_CLASSES_ROOT\IE.AssocFile.URL
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\Software\Classes\IE.AssocFile.URL\DocObject
  • HKEY_CLASSES_ROOT\SystemFileAssociations\.url
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\DescriptionID
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\Clsid
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\Instance
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1F3427C8-5C10-4210-AA03-2EE45287D668}\Instance
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\
  • HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\Software\Classes\Folder
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\EnableShareDenyNone
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_CLASSES_ROOT\Applications\steamwebhelper.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\Software\Classes\Applications\steamwebhelper.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
  • HKEY_CLASSES_ROOT\.exe
  • HKEY_CURRENT_USER\Software\Classes\.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
  • HKEY_CLASSES_ROOT\exefile
  • HKEY_CURRENT_USER\Software\Classes\exefile\CurVer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\CurVer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\
  • HKEY_CURRENT_USER\Software\Classes\exefile
  • HKEY_LOCAL_MACHINE\Software\Classes\exefile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\Software\Classes\SystemFileAssociations\.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\ShellEx\IconHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\Clsid
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.exe
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.exe\Clsid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\Clsid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
  • HKEY_LOCAL_MACHINE\Software\Classes\.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\PropertyBag\ThisPCPolicy
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\ColorPrevalence
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\SystemUsesLightTheme
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PropertyBag\ThisPCPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\UsersFiles\NameSpace
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\UsersFiles\NameSpace\DelegateFolders
  • HKEY_CLASSES_ROOT\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\PropertyBag\ThisPCPolicy
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Metadata
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\PackageOrigin
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\PackageStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\PackageFullName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\PackageType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\Volume
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\OSMaxVersionTested
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\InstalledLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\MutableLink
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\MutableLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\TargetDeviceFamilyName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\OEM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\User\Index\UserSid\S-1-5-21-3968686040-3210279463-847977608-1001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageExternalLocation\Index\UserAndPackage\3^b2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageExternalLocation\Index\UserAndPackage\0^b2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\Flags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\PythonSoftwareFoundation.PythonManager_3847v3x7pw1km\ResourcesConfig
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\pythonsoftwarefoundation.pythonmanager_3847v3x7pw1km\ResourcesConfig\CachedMergedResourcesPriFileName
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Mrt\_Merged
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\LocalizedString
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.lnk
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.lnk
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.lnk\(Default)
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemNameDisplay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.SFGAOFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.DateModified
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.FileName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemPathDisplay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemFolderNameDisplay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemFolderPathDisplay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.IconPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{00021401-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 14
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.DateModified
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.exe
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.exe\(Default)
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\UseOutOfProcHandlerCache
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.ThumbnailCacheId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{446D16B1-8DAD-4870-A748-402EA43D788C} 100
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
  • HKEY_CURRENT_USER\Software\Classes\.png\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice\ProgId
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice\Hash
  • HKEY_CLASSES_ROOT\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\CurVer
  • HKEY_LOCAL_MACHINE\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\CurVer
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\Progid
  • HKEY_LOCAL_MACHINE\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\Progid
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.png
  • HKEY_CLASSES_ROOT\CLSID\{A38B883C-1682-497E-97B0-0A3A9E801682}\OverrideFileSystemProperties
  • HKEY_CLASSES_ROOT\CLSID\{A38B883C-1682-497E-97B0-0A3A9E801682}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}\NoOplock
  • HKEY_CLASSES_ROOT\ExplorerCLSIDFlags\{A38B883C-1682-497E-97B0-0A3A9E801682}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
  • HKEY_LOCAL_MACHINE\Software\Classes\.lnk
  • HKEY_CURRENT_USER\Software\Classes\lnkfile
  • HKEY_LOCAL_MACHINE\Software\Classes\lnkfile
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\lnkfile\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\UseInProcHandlerCache
  • HKEY_CURRENT_USER\Software\Classes\.exe\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\*\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CURRENT_USER\Software\Classes\.lnk\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Directory
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Update.exe
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.url\(Default)
  • HKEY_CURRENT_USER\Software\Classes\exefile\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CURRENT_USER\Software\Classes\.exe\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CLASSES_ROOT\SystemFileAssociations\.exe
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.exe\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\DisableProcessIsolation
  • HKEY_CURRENT_USER\Software\Classes\exefile\Clsid
  • HKEY_CURRENT_USER\Software\Classes\*\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\NoOplock
  • HKEY_CLASSES_ROOT\ExplorerCLSIDFlags\{FBF23B40-E3F0-101B-8488-00AA003E56F8}
  • HKEY_CURRENT_USER\Software\Classes\ExplorerCLSIDFlags\{FBF23B40-E3F0-101B-8488-00AA003E56F8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ExplorerCLSIDFlags\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\UseOutOfProcHandlerCache
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\
  • HKEY_CURRENT_USER\Software\Classes\exefile\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice\ProgId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice\Hash
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.exe\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\CurVer
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_LOCAL_MACHINE\Software\Classes\IE.AssocFile.URL\ShellEx\IconHandler
  • HKEY_CLASSES_ROOT\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}
  • HKEY_CLASSES_ROOT\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{FBF23B40-E3F0-101B-8488-00AA003E56F8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{645FF040-5081-101B-9F08-00AA002F954E}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{645FF040-5081-101B-9F08-00AA002F954E}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{031E4825-7B94-4DC3-B131-E946B44C8DD5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{031E4825-7B94-4DC3-B131-E946B44C8DD5}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CLASSES_ROOT\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{59031A47-3F72-44A7-89C5-5595FE6B30EE}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.HideOnDesktop
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2\Key
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2\VarType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\Key
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\VarType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\Section
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\Key
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\VarType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2\Key
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2\VarType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.FileAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 13
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\IconLayouts
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\IconNameVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\3
  • HKEY_CLASSES_ROOT\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\https\URL Protocol
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX9p17f69fv477faczm440keb1b6qmf2d7
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXezhx1g574qt7ved4c6n8xc7dv69hp5b9
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXt7wecsz30g50zd235hqdg6edj7bz373q
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXrzncjcz58hgp52t1bcacmj7qj4p7fgy4
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX29xjyxk6s619ed3bxzny0w9dtw9j3bj7
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXsb1zgj7e45ja97qva5xv68rnf2mweyv6
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX14sgk3n9en7k0bkktc9b16422015ebss
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX4vpjzagr9bt8abh3j750s58kqkbxhb97
  • HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Instance
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\URLAssociations\https
  • HKEY_CLASSES_ROOT\CLSID\{4A04656D-52AA-49DE-8A09-CB178760E748}\Instance
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXs43fd19nmbh94dynnq1r143fs10qjvhg
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXc9hsmcxm3scx9z9f7a1fvjq1e0pmeg3a
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXc6tpxne90zak0nztv1brdbfwsjmes2qq
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\UrlAssociations\https
  • HKEY_LOCAL_MACHINE\Software\Clients\Contacts\Address Book\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Search\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\UrlAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Paint
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Notepad\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Media Player
  • HKEY_LOCAL_MACHINE\Software\Clients\Media\Windows Media Player\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Photo Viewer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Photo Viewer\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Microsoft Edge
  • HKEY_LOCAL_MACHINE\Software\Clients\StartMenuInternet\Microsoft Edge\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Google Chrome
  • HKEY_LOCAL_MACHINE\Software\Clients\StartMenuInternet\Google Chrome\Capabilities\UrlAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\Software\Clients\StartMenuInternet\Google Chrome\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\https
  • HKEY_CURRENT_USER\Software\Classes\https
  • HKEY_LOCAL_MACHINE\Software\Classes\https
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice\ProgId
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice\Hash
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\
  • HKEY_CLASSES_ROOT\ChromeHTML
  • HKEY_CURRENT_USER\Software\Classes\ChromeHTML
  • HKEY_CURRENT_USER\Software\Classes\ChromeHTML\CurVer
  • HKEY_CURRENT_USER\Software\Classes\ChromeHTML\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML\DefaultIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\Software\Classes\ChromeHTML
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML\CurVer
  • HKEY_CLASSES_ROOT\.url
  • HKEY_LOCAL_MACHINE\Software\Classes\IE.AssocFile.URL\CurVer
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\IE.AssocFile.URL\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\.URL\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\ShellEx\{000214F9-0000-0000-C000-000000000046}\(Default)
  • HKEY_CURRENT_USER\Software\Classes\.url
  • HKEY_LOCAL_MACHINE\Software\Classes\.url
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\PerceivedType
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.url
  • HKEY_LOCAL_MACHINE\Software\Classes\SystemFileAssociations\.url
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\Software\Classes\IE.AssocFile.URL\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CURRENT_USER\Software\Classes\.URL\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_LOCAL_MACHINE\Software\Classes\IE.AssocFile.URL\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_CURRENT_USER\Software\Classes\.URL\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_CURRENT_USER\Software\Classes\*\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\ShellFolder
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3756E7F5-E514-4776-A32B-EB24BC1EFE7A}\Instance
  • HKEY_CURRENT_USER\Software\Classes\*\
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\tabsets
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.zip\tabsets
  • HKEY_LOCAL_MACHINE\Software\Classes\*\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.zip\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\compressed
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\CLSID
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\{000214F9-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\PreviewDetails
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\PreviewDetails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\PreviewDetails
  • HKEY_CURRENT_USER\Software\Classes\*\PreviewDetails
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{088E3905-0323-4B02-9826-5D99428E115F}
  • HKEY_CURRENT_USER\Software\Classes\Interface\{F2153260-232E-4474-9D0A-9F2AB153441D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F2153260-232E-4474-9D0A-9F2AB153441D}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F2153260-232E-4474-9D0A-9F2AB153441D}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecycleFiles
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{528c102f-0000-0000-0000-300300000000}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{528c102f-0000-0000-0000-300300000000}\MaxCapacity
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{528c102f-0000-0000-0000-300300000000}\NukeOnDelete
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1CF1260C-4DD0-4EBB-811F-33C572699FDE}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{1CF1260C-4DD0-4EBB-811F-33C572699FDE}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A0953C92-50DC-43BF-BE83-3742FED03C9C}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{A0953C92-50DC-43BF-BE83-3742FED03C9C}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\DefaultIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{3ADD1653-EB32-4CB0-BBD7-DFA0ABB5ACCA}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\DefaultIcon
  • HKEY_CLASSES_ROOT\CLSID\{57635537-C856-4CC2-AE5C-62C34708070C}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\ShellEx\DataHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\DataHandler
  • HKEY_CURRENT_USER\Software\Classes\.zip\ShellEx\DataHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\ShellEx\DataHandler
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.zip\ShellEx\DataHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\ShellEx\DataHandler
  • HKEY_CURRENT_USER\Software\Classes\Folder\ShellEx\DataHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\DataHandler
  • HKEY_CURRENT_USER\Software\Classes\*\ShellEx\DataHandler
  • HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\DataHandler
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\DataHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\DataHandler
  • HKEY_CURRENT_USER\Software\Classes\Interface\{FC992F1F-DEBB-4596-B355-50C7A6DD1222}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC992F1F-DEBB-4596-B355-50C7A6DD1222}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC992F1F-DEBB-4596-B355-50C7A6DD1222}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\shellex\ContextMenuHandlers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\ContextMenuHandlers\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\ContextMenuHandlers\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\shellex\ContextMenuHandlers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Library Location
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Library Location\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Library Location\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Offline Files
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Offline Files\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Offline Files\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PintoStartScreen
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PintoStartScreen\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PintoStartScreen\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\SuppressionPolicy
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\ FileSyncEx
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\SuppressionPolicy
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default)
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\EPP
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\(Default)
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\ModernSharing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ModernSharing\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ModernSharing\(Default)
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\Open With
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With\(Default)
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu\(Default)
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\Sharing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Sharing\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Sharing\(Default)
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\WorkFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WorkFolders\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WorkFolders\(Default)
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\SuppressionPolicy
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\CopyAsPathMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\CopyAsPathMenu\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\CopyAsPathMenu\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SendTo\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SendTo\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\SuppressionPolicy
  • HKEY_CLASSES_ROOT\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{F3D06E7C-1E45-4A26-847E-F9FCDEE59BE0}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{A470F8CF-A1E8-4F65-8335-227475AA5C46}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}\shellex\NoAddToRecent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{09799AFB-AD67-11D1-ABCD-00C04FC30936}
  • HKEY_CURRENT_USER\Software\Classes\*\NoRecentDocs
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{09799AFB-AD67-11D1-ABCD-00C04FC30936}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09799AFB-AD67-11d1-ABCD-00C04FC30936}\flags
  • HKEY_CLASSES_ROOT\CLSID\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{09A47860-11B0-4DA5-AFA5-26D86198A780}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{A2A9545D-A0C2-42B4-9708-A0B2BADD77C8}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{470C0EBD-5D73-4D58-9CED-E91E22E23282}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{474C98EE-CF3D-41F5-80E3-4AAB0AB04301}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{3DAD6C5D-2167-4CAE-9914-F99E41C12CFA}\shellex\MayChangeDefaultMenu
  • HKEY_CLASSES_ROOT\CLSID\{B8CDCB65-B1BF-4B42-9428-1DFDB7EE92AF}\shellex\MayChangeDefaultMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoRecentDocs
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\shell\Explore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\shell\find
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\MultiSelectModel
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultipleInvokePromptMinimum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultipleInvokePromptMinimum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SeparatorBefore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SeparatorAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\Shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\Shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\Explore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\DefaultAppliesTo
  • HKEY_CURRENT_USER\Software\Classes\*\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ResolveLinksInvokeBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\InvokeCommandOnSelection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\OpenControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\OpenControlPanelPage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Progid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\CompressedFolder_.zip
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids\CompressedFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList\MRUList
  • HKEY_CLASSES_ROOT\.zip\OpenWithList
  • HKEY_CLASSES_ROOT\SystemFileAssociations\compressed\OpenWithList
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\compressed\OpenWithList
  • HKEY_CLASSES_ROOT\*\OpenWithProgids
  • HKEY_CLASSES_ROOT\Applications
  • HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\location
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\Software\Clients\Contacts\Address Book\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\Software\Microsoft\IsoBurn\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IsoBurn\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IsoBurn\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IsoBurn\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Search\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Notepad\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Notepad\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Notepad\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Notepad\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\Software\Clients\Media\Windows Media Player\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Photo Viewer\Capabilities
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CLASSES_ROOT\Applications\accwiz.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\accwiz.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\ARTGALRY.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\ARTGALRY.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\awdvstub.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\awdvstub.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\cag.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cag.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\CChat.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\CChat.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\cdfview.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cdfview.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\cmd.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\CMMGR32.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\CMMGR32.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\cryptext.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cryptext.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\datainst.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\datainst.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\depends.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\depends.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\drwatson.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\dsquery.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\explorer.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\explorer.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\faxcover.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\faxcover.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\finder.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\finder.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\fontview.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\fontview.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\fpidcwiz.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\fpidcwiz.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\graflink.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\graflink.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\grpconv.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\grpconv.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\helpctr.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\helpctr.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\hh.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\hh.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\HYPERTRM.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\HYPERTRM.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\iexplore.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command\(Default)
  • HKEY_CLASSES_ROOT\Applications\inetcpl.cpl
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\inetcpl.cpl\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\ISIGNUP.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\ISIGNUP.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\isoburn.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\isoburn.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\isoburn.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\isoburn.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\isoburn.exe\shell
  • HKEY_CLASSES_ROOT\Applications\kodakprv.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\kodakprv.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\licensemanagershellext.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\licensemanagershellext.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\MMC.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\MMC.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\mnyimprt.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mnyimprt.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\mplayer.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mplayer.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\msconf.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\msconf.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\mshta.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mshta.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\msiexec.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\msiexec.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\msimn.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\msimn.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\MSInfo32.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\MSInfo32.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\mspaint.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\command\(Default)
  • HKEY_CLASSES_ROOT\Applications\msrating.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\msrating.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\netshell.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\netshell.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\notepad.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\command\(Default)
  • HKEY_CLASSES_ROOT\Applications\NTVDM.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\NTVDM.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\NTVDM.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\NTVDM.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\NTVDM.exe\shell
  • HKEY_CLASSES_ROOT\Applications\oledb32.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\oledb32.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\OpenWith.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\ORGCHART.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\ORGCHART.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\OSA.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OSA.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\Outlook.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Outlook.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\perfmon.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\perfmon.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\photoviewer.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\print
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\print\NeverDefault
  • HKEY_CLASSES_ROOT\Applications\provtool.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\provtool.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\rasphone.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\rasphone.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\regedit.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\regedit.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\runtimebroker.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\runtimebroker.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\runtimebroker.exe\
  • HKEY_CURRENT_USER\Software\Classes\Applications\runtimebroker.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\runtimebroker.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\runtimebroker.exe\shell
  • HKEY_CLASSES_ROOT\Applications\sdclt.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\sdclt.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\sdclt.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\shdocvw.dll
  • HKEY_CURRENT_USER\Software\Classes\Applications\shdocvw.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\shdocvw.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\shell32.dll
  • HKEY_CURRENT_USER\Software\Classes\Applications\shell32.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\shell32.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\shscrap.dll
  • HKEY_CURRENT_USER\Software\Classes\Applications\shscrap.dll
  • HKEY_CLASSES_ROOT\Applications\snapview.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\snapview.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\snapview.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\SystemReset.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\SystemReset.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SystemReset.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SystemReset.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SystemReset.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SystemReset.exe\shell
  • HKEY_CLASSES_ROOT\Applications\taskmgr.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\taskmgr.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\taskmgr.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\taskmgr.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\taskmgr.exe\NoStaticDefaultVerb
  • HKEY_CURRENT_USER\Software\Classes\Applications\taskmgr.exe\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\taskmgr.exe\shell
  • HKEY_CLASSES_ROOT\Applications\themes.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\themes.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\themes.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\Ttxmpc97.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\Ttxmpc97.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Ttxmpc97.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\url.dll
  • HKEY_CURRENT_USER\Software\Classes\Applications\url.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\url.dll\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\wab.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\wab.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wab.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\WB32.EXE
  • HKEY_CURRENT_USER\Software\Classes\Applications\WB32.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WB32.EXE\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\winhlp32.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\winhlp32.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\winhlp32.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\WINWORD.EXE
  • HKEY_CURRENT_USER\Software\Classes\Applications\WINWORD.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WINWORD.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WINWORD.EXE\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WINWORD.EXE\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WINWORD.EXE\shell
  • HKEY_CLASSES_ROOT\Applications\wltmime.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\wltmime.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wltmime.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\wmpdmc.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\wmpdmc.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmpdmc.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmpdmc.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmpdmc.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmpdmc.exe\shell
  • HKEY_CLASSES_ROOT\Applications\wmplayer.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\wmplayer.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell
  • HKEY_CURRENT_USER\Software\Classes\Applications\wmplayer.exe\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\Play
  • HKEY_CURRENT_USER\Software\Classes\Applications\wmplayer.exe\shell\play
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\command
  • HKEY_CURRENT_USER\Software\Classes\Applications\wmplayer.exe\shell\play\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\command\(Default)
  • HKEY_CLASSES_ROOT\Applications\wordpad.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\wordpad.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell
  • HKEY_CURRENT_USER\Software\Classes\Applications\wordpad.exe\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open
  • HKEY_CURRENT_USER\Software\Classes\Applications\wordpad.exe\shell\open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\command
  • HKEY_CURRENT_USER\Software\Classes\Applications\wordpad.exe\shell\open\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\command\(Default)
  • HKEY_CLASSES_ROOT\Applications\wpnpinst.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\wpnpinst.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wpnpinst.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\WScript.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\WScript.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WScript.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\wusa.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\wusa.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wusa.exe\NoOpenWith
  • HKEY_CLASSES_ROOT\Applications\zipfldr.dll
  • HKEY_CURRENT_USER\Software\Classes\Applications\zipfldr.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\zipfldr.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\AppUserModelID
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\grouppolicypath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\grouppolicyismultisz
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\grouppolicymultiszSeparatorChar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\Value
  • HKEY_LOCAL_MACHINE\software\policies\Microsoft\AppHVSI
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\Device\AppHVSI
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\Shell\Open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\NoSmartScreen
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\SmartScreen\EnableSmartScreenInShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\SmartScreen\EnableSmartScreenInShell\Behavior
  • HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\Device\SmartScreen
  • HKEY_LOCAL_MACHINE\
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\EnableSmartScreen
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SmartScreenEnabled
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
  • HKEY_CLASSES_ROOT\.ade
  • HKEY_CLASSES_ROOT\.adp
  • HKEY_CLASSES_ROOT\.app
  • HKEY_CLASSES_ROOT\.asp
  • HKEY_CURRENT_USER\Software\Classes\.asp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
  • HKEY_CLASSES_ROOT\.bas
  • HKEY_CURRENT_USER\Software\Classes\.bas
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
  • HKEY_CLASSES_ROOT\.bat
  • HKEY_CURRENT_USER\Software\Classes\.bat
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
  • HKEY_CLASSES_ROOT\.cer
  • HKEY_CURRENT_USER\Software\Classes\.cer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
  • HKEY_CLASSES_ROOT\.chm
  • HKEY_CURRENT_USER\Software\Classes\.chm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
  • HKEY_CLASSES_ROOT\.cmd
  • HKEY_CURRENT_USER\Software\Classes\.cmd
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
  • HKEY_CLASSES_ROOT\.cnt
  • HKEY_CLASSES_ROOT\.com
  • HKEY_CURRENT_USER\Software\Classes\.com
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
  • HKEY_CLASSES_ROOT\.cpl
  • HKEY_CURRENT_USER\Software\Classes\.cpl
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
  • HKEY_CLASSES_ROOT\.crt
  • HKEY_CURRENT_USER\Software\Classes\.crt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
  • HKEY_CLASSES_ROOT\.csh
  • HKEY_CLASSES_ROOT\.der
  • HKEY_CURRENT_USER\Software\Classes\.der
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.der\(Default)
  • HKEY_CLASSES_ROOT\.fxp
  • HKEY_CLASSES_ROOT\.gadget
  • HKEY_CLASSES_ROOT\.grp
  • HKEY_CURRENT_USER\Software\Classes\.grp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.grp\(Default)
  • HKEY_CLASSES_ROOT\.hlp
  • HKEY_CURRENT_USER\Software\Classes\.hlp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hlp\(Default)
  • HKEY_CLASSES_ROOT\.hpj
  • HKEY_CLASSES_ROOT\.hta
  • HKEY_CURRENT_USER\Software\Classes\.hta
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hta\(Default)
  • HKEY_CLASSES_ROOT\.img
  • HKEY_CURRENT_USER\Software\Classes\.img
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.img\(Default)
  • HKEY_CLASSES_ROOT\.inf
  • HKEY_CURRENT_USER\Software\Classes\.inf
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf\(Default)
  • HKEY_CLASSES_ROOT\.ins
  • HKEY_CLASSES_ROOT\.iso
  • HKEY_CURRENT_USER\Software\Classes\.iso
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso\(Default)
  • HKEY_CLASSES_ROOT\.isp
  • HKEY_CLASSES_ROOT\.its
  • HKEY_CLASSES_ROOT\.js
  • HKEY_CURRENT_USER\Software\Classes\.js
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
  • HKEY_CLASSES_ROOT\.jse
  • HKEY_CURRENT_USER\Software\Classes\.JSE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.JSE\(Default)
  • HKEY_CLASSES_ROOT\.ksh
  • HKEY_CLASSES_ROOT\.mad
  • HKEY_CLASSES_ROOT\.maf
  • HKEY_CLASSES_ROOT\.mag
  • HKEY_CLASSES_ROOT\.mam
  • HKEY_CLASSES_ROOT\.maq
  • HKEY_CLASSES_ROOT\.mar
  • HKEY_CLASSES_ROOT\.mas
  • HKEY_CLASSES_ROOT\.mat
  • HKEY_CLASSES_ROOT\.mau
  • HKEY_CLASSES_ROOT\.mav
  • HKEY_CLASSES_ROOT\.maw
  • HKEY_CLASSES_ROOT\.mcf
  • HKEY_CLASSES_ROOT\.mda
  • HKEY_CLASSES_ROOT\.mdb
  • HKEY_CLASSES_ROOT\.mde
  • HKEY_CLASSES_ROOT\.mdt
  • HKEY_CLASSES_ROOT\.mdw
  • HKEY_CLASSES_ROOT\.mdz
  • HKEY_CLASSES_ROOT\.msc
  • HKEY_CURRENT_USER\Software\Classes\.msc
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msc\(Default)
  • HKEY_CLASSES_ROOT\.msh
  • HKEY_CLASSES_ROOT\.msh1
  • HKEY_CLASSES_ROOT\.msh1xml
  • HKEY_CLASSES_ROOT\.msh2
  • HKEY_CLASSES_ROOT\.msh2xml
  • HKEY_CLASSES_ROOT\.mshxml
  • HKEY_CLASSES_ROOT\.msi
  • HKEY_CURRENT_USER\Software\Classes\.msi
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msi\(Default)
  • HKEY_CLASSES_ROOT\.msp
  • HKEY_CURRENT_USER\Software\Classes\.msp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msp\(Default)
  • HKEY_CLASSES_ROOT\.mst
  • HKEY_CLASSES_ROOT\.msu
  • HKEY_CURRENT_USER\Software\Classes\.msu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msu\(Default)
  • HKEY_CLASSES_ROOT\.ops
  • HKEY_CLASSES_ROOT\.pcd
  • HKEY_CLASSES_ROOT\.pif
  • HKEY_CURRENT_USER\Software\Classes\.pif
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pif\(Default)
  • HKEY_CLASSES_ROOT\.pl
  • HKEY_CURRENT_USER\Software\Classes\.pl
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pl\(Default)
  • HKEY_CLASSES_ROOT\.plg
  • HKEY_CURRENT_USER\Software\Classes\.plg
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.plg\(Default)
  • HKEY_CLASSES_ROOT\.prf
  • HKEY_CURRENT_USER\Software\Classes\.prf
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.prf\(Default)
  • HKEY_CLASSES_ROOT\.prg
  • HKEY_CLASSES_ROOT\.printerexport
  • HKEY_CURRENT_USER\Software\Classes\.printerExport
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.printerExport\(Default)
  • HKEY_CLASSES_ROOT\.ps1
  • HKEY_CURRENT_USER\Software\Classes\.ps1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ps1\(Default)
  • HKEY_CLASSES_ROOT\.ps1xml
  • HKEY_CURRENT_USER\Software\Classes\.ps1xml
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ps1xml\(Default)
  • HKEY_CLASSES_ROOT\.ps2
  • HKEY_CLASSES_ROOT\.ps2xml
  • HKEY_CLASSES_ROOT\.psc1
  • HKEY_CURRENT_USER\Software\Classes\.psc1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.psc1\(Default)
  • HKEY_CLASSES_ROOT\.psc2
  • HKEY_CLASSES_ROOT\.psd1
  • HKEY_CURRENT_USER\Software\Classes\.psd1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.psd1\(Default)
  • HKEY_CLASSES_ROOT\.psm1
  • HKEY_CURRENT_USER\Software\Classes\.psm1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.psm1\(Default)
  • HKEY_CLASSES_ROOT\.pst
  • HKEY_CLASSES_ROOT\.reg
  • HKEY_CURRENT_USER\Software\Classes\.reg
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.reg\(Default)
  • HKEY_CLASSES_ROOT\.scf
  • HKEY_CURRENT_USER\Software\Classes\.scf
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scf\(Default)
  • HKEY_CLASSES_ROOT\.scr
  • HKEY_CURRENT_USER\Software\Classes\.scr
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scr\(Default)
  • HKEY_CLASSES_ROOT\.sct
  • HKEY_CURRENT_USER\Software\Classes\.sct
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sct\(Default)
  • HKEY_CLASSES_ROOT\.shb
  • HKEY_CLASSES_ROOT\.shs
  • HKEY_CLASSES_ROOT\.theme
  • HKEY_CURRENT_USER\Software\Classes\.theme
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.theme\(Default)
  • HKEY_CLASSES_ROOT\.tmp
  • HKEY_CURRENT_USER\Software\Classes\.URL
  • HKEY_CLASSES_ROOT\.vb
  • HKEY_CLASSES_ROOT\.vbe
  • HKEY_CURRENT_USER\Software\Classes\.VBE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.VBE\(Default)
  • HKEY_CLASSES_ROOT\.vbp
  • HKEY_CLASSES_ROOT\.vbs
  • HKEY_CURRENT_USER\Software\Classes\.vbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs\(Default)
  • HKEY_CLASSES_ROOT\.vhd
  • HKEY_CURRENT_USER\Software\Classes\.vhd
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vhd\(Default)
  • HKEY_CLASSES_ROOT\.vhdx
  • HKEY_CURRENT_USER\Software\Classes\.vhdx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vhdx\(Default)
  • HKEY_CLASSES_ROOT\.vsmacros
  • HKEY_CLASSES_ROOT\.vsw
  • HKEY_CLASSES_ROOT\.webpnp
  • HKEY_CURRENT_USER\Software\Classes\.webpnp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.webpnp\(Default)
  • HKEY_CLASSES_ROOT\.ws
  • HKEY_CLASSES_ROOT\.wsc
  • HKEY_CURRENT_USER\Software\Classes\.wsc
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wsc\(Default)
  • HKEY_CLASSES_ROOT\.wsf
  • HKEY_CURRENT_USER\Software\Classes\.WSF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WSF\(Default)
  • HKEY_CLASSES_ROOT\.wsh
  • HKEY_CURRENT_USER\Software\Classes\.WSH
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WSH\(Default)
  • HKEY_CLASSES_ROOT\.xnk
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\EditFlags
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\ExecutableTypes
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\Shell\Open\command
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\Shell\Open\Command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\LocalServerOnly
  • HKEY_CLASSES_ROOT\CLSID\{11DBB47C-A525-400B-9E80-A54615A090C0}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{11DBB47C-A525-400B-9E80-A54615A090C0}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11dbb47c-a525-400b-9e80-a54615a090c0}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\StoreInit
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\StoreInit\AppExtensionPackageEventVersion
  • HKEY_CURRENT_USER\Software\Classes\Interface\{831D1DFF-7F57-4720-87E4-CB57D6214428}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{831D1DFF-7F57-4720-87E4-CB57D6214428}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{831D1DFF-7F57-4720-87E4-CB57D6214428}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{831D1DFF-7F57-4720-87E4-CB57D6214428}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${b71d7125-ae43-46d2-b0d5-7d69e6addd38}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap\Current
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${b71d7125-ae43-46d2-b0d5-7d69e6addd38}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap\Current\Data
  • HKEY_CURRENT_USER\Software\Classes\Interface\{BA2D7C62-1BDA-448F-996A-BE6F2DFC3E49}
  • HKEY_LOCAL_MACHINE\Software\Classes\PackagedCom
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\LaunchExplorerFlags
  • HKEY_CURRENT_USER\Software\Classes\Interface\{000214E2-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{000214E2-0000-0000-C000-000000000046}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{000214E2-0000-0000-C000-000000000046}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{000214E2-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$$windows.data.platform.partitioning.systempartitionindex\Current
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$$windows.data.platform.partitioning.systempartitionindex\Current\Data
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\
  • HKEY_CLASSES_ROOT\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\Instance
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213E82-BCFD-4C4F-8817-BB27601267A9}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\Parent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\CanonicalName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\Theme
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\LayoutType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\TopViewPersistence
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\ViewSettingsPersistence
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\Mode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\Class
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\MostRelevant
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Modifiers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\DefaultView
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213E82-BCFD-4C4F-8817-BB27601267A9}\TopViews
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Inherit
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Inherit
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Shell\Bags\AllFolders\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance
  • HKEY_CLASSES_ROOT\Applications\Explorer.EXE
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\ShellEx\LibraryDescriptionHandler
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_CURRENT_USER\Software\Classes\.zip\ShellEx\LibraryDescriptionHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_CURRENT_USER\Software\Classes\.zip\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\ShellEx\LibraryDescriptionHandler
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.zip\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_LOCAL_MACHINE\Software\Classes\SystemFileAssociations\compressed
  • HKEY_CURRENT_USER\Software\Classes\Folder\ShellEx\LibraryDescriptionHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\LibraryDescriptionHandler
  • HKEY_CURRENT_USER\Software\Classes\Folder\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_CURRENT_USER\Software\Classes\*\ShellEx\LibraryDescriptionHandler
  • HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\LibraryDescriptionHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\LibraryDescriptionHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\LibraryDescriptionHandler
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_CURRENT_USER\Software\Classes\.zip\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.zip\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_CURRENT_USER\Software\Classes\Folder\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_CURRENT_USER\Software\Classes\*\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_CURRENT_USER\Software\Classes\CompressedFolder\Shell
  • HKEY_CLASSES_ROOT\CLSID\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\MaxRecentDocs
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\LibraryDescriptionHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\ShellEx\LibraryDescriptionHandler
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.zip\ShellEx\LibraryDescriptionHandler
  • HKEY_CURRENT_USER\Software\Classes\Interface\{15F99879-AA48-571F-845D-144893440CFD}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15f99879-aa48-571f-845d-144893440cfd}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{15f99879-aa48-571f-845d-144893440cfd}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15f99879-aa48-571f-845d-144893440cfd}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\{973810AE-9599-4B88-9E4D-6EE98C9552DA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\AllowSilentDefaultTakeOver
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\RemoveAccess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\PackageId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\MajorDoc
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\MRUListEx
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\MRUList
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\5
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\7
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\6
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\0
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\3
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\FriendlyAppName
  • HKEY_CLASSES_ROOT\Applications\Explorer.exe
  • HKEY_CURRENT_USER\Software\Classes\Applications\explorer.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\explorer.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\explorer.exe\shell
  • HKEY_CURRENT_USER\Software\Classes\Applications\Explorer.exe
  • HKEY_LOCAL_MACHINE\Software\Classes\Applications\Explorer.exe
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\Explorer.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\Explorer.exe.ApplicationCompany
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\8
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\0
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CLASSES_ROOT\CLSID\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\Attributes
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\WantsParseDisplayName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\Software\Classes\CompressedFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\NoDefaultToFS
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\ParseDisplayNameNeedsURL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\SafeRootForMTA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\NoLocalizedNameInTarget
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}\ShellFolder
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Unspecified
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\OpenFileIn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\SaveFileIn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\CopyFrom
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\PasteTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\MoveTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\CopyPaste
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Share
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Move
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Create
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\OpenIn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\CreateIn
  • HKEY_LOCAL_MACHINE\Software\Classes\.zip\OpenWithProgids
  • HKEY_CURRENT_USER\Software\Classes\Folder
  • HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{AD974AE2-E292-4083-A280-0342D68DAF55}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{AD974AE2-E292-4083-A280-0342D68DAF55}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{679F85CB-0220-4080-B29B-5540CC05AAB6}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{679F85CB-0220-4080-B29B-5540CC05AAB6}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Url History
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Url History
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Url History\DaysToKeep
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\DisableContextualTabset
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\tabsets
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\tabsets
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\tabsets
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\tabsets\UseIdentityItem
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\tabsets\location
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{3756E7F5-E514-4776-A32B-EB24BC1EFE7A}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BYPASS_SBE_D14030E5D684
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BYPASS_SBE_D14030E5D684
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Feeds
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\CurrentVersion
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{C206F324-BB45-4765-93FF-3BCA7306FF2E}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C206F324-BB45-4765-93FF-3BCA7306FF2E}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{08D5BFBF-FBCA-4322-9F70-CA9F66F8ED6A}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{08D5BFBF-FBCA-4322-9F70-CA9F66F8ED6A}\Instance
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\StatusBar
  • HKEY_LOCAL_MACHINE\Software\Classes\*
  • HKEY_CURRENT_USER\Software\Classes\*\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\StatusBar
  • HKEY_LOCAL_MACHINE\Software\Classes\AllFilesystemObjects
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{6BC752F7-9721-49F8-873B-9FECB6215DE3}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6BC752F7-9721-49F8-873B-9FECB6215DE3}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\2012
  • HKEY_CURRENT_USER\Software\Classes\*\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_LOCAL_MACHINE\Software\Classes\*\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\{FDBEE76E-F12B-408E-93AB-9BE8521000D9}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{FF393560-C2A7-11CF-BFF4-444553540000}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.IsPinnedToNameSpaceTree
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A8CDFF1C-4878-43BE-B5FD-F8091C1C60D0}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{A8CDFF1C-4878-43BE-B5FD-F8091C1C60D0}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\FormatForDisplayHelper
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{CC89BA65-661C-494A-85C0-5D697DFEB30C}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{CC89BA65-661C-494A-85C0-5D697DFEB30C}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\MS Shell Dlg
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Icons
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000020502
  • HKEY_CURRENT_USER\Software\Classes\.exe_
  • HKEY_LOCAL_MACHINE\Software\Classes\.exe_
  • HKEY_CURRENT_USER\Software\Classes\.exe_\OpenWithProgids
  • HKEY_LOCAL_MACHINE\Software\Classes\.exe_\OpenWithProgids
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithProgids
  • HKEY_LOCAL_MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.exe_
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Unknown
  • HKEY_LOCAL_MACHINE\Software\Classes\Unknown
  • HKEY_CURRENT_USER\Software\Classes\Unknown\CurVer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\CurVer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\EditFlags
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\Software\Classes\SystemFileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\*\EditFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\EditFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\EditFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NoStaticDefaultVerb
  • HKEY_CURRENT_USER\Software\Classes\Unknown\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Unknown\shell\openas
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\NeverDefault
  • HKEY_CURRENT_USER\Software\Classes\Unknown\shell\openas\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1807
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1807
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum\Implementing
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2781761e-28e0-4109-99fe-b9d127c57afe}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
  • HKEY_CURRENT_USER\Software\Classes\CLSID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000002F-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0000002F-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000002F-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000300-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000300-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000300-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000300-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000301-A8F2-4877-BA0A-FD2B6645FB94}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000301-A8F2-4877-BA0A-FD2B6645FB94}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000301-A8F2-4877-BA0A-FD2B6645FB94}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000301-A8F2-4877-BA0A-FD2B6645FB94}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000303-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000303-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000303-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000303-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000304-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000304-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000304-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000304-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000305-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000305-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000305-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000305-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000306-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000306-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000306-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000306-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000308-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000308-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000308-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000308-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000309-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000309-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000309-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000309-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000030B-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0000030B-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000030B-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000030B-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000315-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000315-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000315-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000316-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000316-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000316-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000319-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000031A-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000031D-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0000031D-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000031D-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000031D-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000320-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000320-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000320-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000320-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000327-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000327-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000327-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000327-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000032E-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0000032E-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000032E-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000032E-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000355-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000355-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000355-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000355-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000050B-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000514-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000051A-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0000051A-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000051A-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000051A-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000535-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000541-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000542-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000560-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000560-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000560-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000560-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000602-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000602-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000602-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000602-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000609-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000609-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000609-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000609-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000615-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000615-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000615-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000615-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000618-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000618-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000618-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000618-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000061B-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0000061B-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000061B-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000061B-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000061E-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0000061E-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0000061E-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0000061E-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000621-0000-0010-8000-00AA006D2EA4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00000621-0000-0010-8000-00AA006D2EA4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00000621-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000621-0000-0010-8000-00AA006D2EA4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020000-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020000-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020000-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020001-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020001-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020001-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020001-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020003-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020003-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020003-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020003-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002000F-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0002000F-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020421-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020421-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020421-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020421-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020422-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020422-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020422-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020422-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020425-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020425-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020425-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020425-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020810-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020811-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\RemovalTools\MRT
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020811-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020811-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\MRT\GUID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020811-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020820-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020820-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020821-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020821-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020821-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020821-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020900-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020900-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020900-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020900-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020906-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020906-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020C01-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020D75-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020D75-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020D75-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00021400-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021400-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00022601-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00022601-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00022601-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00022601-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00022602-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00022602-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00022602-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00022602-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00022603-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00022603-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00022603-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00022603-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002DF02-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0002DF02-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002DF02-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0002DF02-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002E005-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0002E005-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0002E005-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002E006-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0002E006-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0002E006-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0002E006-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0003000A-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0003000A-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0003000A-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0003000C-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0003000C-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0003000C-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0003000C-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0003000D-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0003000D-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0003000D-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0003000E-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0003000E-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0003000E-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0003000E-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C101C-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{000C101C-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C101C-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000C101C-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C101D-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{000C101D-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C101D-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000C101D-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C103E-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{000C103E-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C103E-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000C103E-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C1090-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{000C1090-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C1090-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000C1090-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C1094-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{000C1094-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{000C1094-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{000C1094-0000-0000-C000-000000000046}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0010668C-0801-4DA6-A4A4-826522B6D28F}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0010668C-0801-4DA6-A4A4-826522B6D28F}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0010668C-0801-4DA6-A4A4-826522B6D28F}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0010668C-0801-4DA6-A4A4-826522B6D28F}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00108226-EE41-44A2-9E9C-4BE4D5B1D2CD}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00108226-EE41-44A2-9E9C-4BE4D5B1D2CD}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00108226-EE41-44A2-9E9C-4BE4D5B1D2CD}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00108226-EE41-44A2-9E9C-4BE4D5B1D2CD}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0010890E-8789-413C-ADBC-48F5B511B3AF}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0010890E-8789-413C-ADBC-48F5B511B3AF}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0010890e-8789-413c-adbc-48f5b511b3af}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{001DC1E0-0F8C-4720-98DB-39D32A661422}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{001DC1E0-0F8C-4720-98DB-39D32A661422}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{001DC1E0-0F8C-4720-98DB-39D32A661422}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{001DC1E0-0F8C-4720-98DB-39D32A661422}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{002EB8C6-3D34-4848-9A6D-58E388D55908}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{002EB8C6-3D34-4848-9A6D-58E388D55908}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{002EB8C6-3D34-4848-9A6D-58E388D55908}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{002EB8C6-3D34-4848-9A6D-58E388D55908}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{003E0278-ECA8-4BB8-A256-3689CA1C2600}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{003e0278-eca8-4bb8-a256-3689ca1c2600}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{003e0278-eca8-4bb8-a256-3689ca1c2600}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{006E61DF-1A43-4F2C-B26F-780BAEA3A92D}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{006E61DF-1A43-4F2C-B26F-780BAEA3A92D}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{006E61DF-1A43-4F2C-B26F-780BAEA3A92D}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\System\Setup
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006E61DF-1A43-4F2C-B26F-780BAEA3A92D}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0070746C-9A38-4236-822A-72CC4E5C8087}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0070746C-9A38-4236-822A-72CC4E5C8087}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0070746C-9A38-4236-822A-72CC4E5C8087}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0070746C-9A38-4236-822A-72CC4E5C8087}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00722F5F-CB8F-44D3-AC27-CC37F76CFE92}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00722F5F-CB8F-44D3-AC27-CC37F76CFE92}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0095B496-F121-4256-96A0-09179828CC16}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0095B496-F121-4256-96A0-09179828CC16}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0095b496-f121-4256-96a0-09179828cc16}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0095b496-f121-4256-96a0-09179828cc16}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{009F3B45-8A6B-4360-B997-B2A009A16402}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{009F3B45-8A6B-4360-B997-B2A009A16402}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{009F3B45-8A6B-4360-B997-B2A009A16402}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{009F3B45-8A6B-4360-B997-B2A009A16402}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EnableRemoteManagedDefaults
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableLocalAdminMerge
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00A77FF7-A514-493E-B721-CDF8CB0F5B59}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00A77FF7-A514-493E-B721-CDF8CB0F5B59}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00A77FF7-A514-493e-B721-CDF8CB0F5B59}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00A77FF7-A514-493e-B721-CDF8CB0F5B59}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00B01B2E-B1FE-33A6-AD40-57DE8358DC7D}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00B01B2E-B1FE-33A6-AD40-57DE8358DC7D}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00B01B2E-B1FE-33A6-AD40-57DE8358DC7D}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00B01B2E-B1FE-33A6-AD40-57DE8358DC7D}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00B8308C-09F2-4C18-A7B0-4594D6B22EFE}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00B8308C-09F2-4c18-A7B0-4594D6B22EFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00B8308C-09F2-4c18-A7B0-4594D6B22EFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\BetaPlatform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\BetaPlatform
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00BB2764-6A77-11D0-A535-00C04FD7D062}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00BB2764-6A77-11D0-A535-00C04FD7D062}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2764-6A77-11D0-A535-00C04FD7D062}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00C429C0-0BA9-11D2-A484-00C04F8EFB69}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\InstallLocation
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00C429C0-0BA9-11d2-A484-00C04F8EFB69}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00C429C0-0BA9-11d2-A484-00C04F8EFB69}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00C4E345-813F-4401-9A9F-29F7A576FA11}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00C4E345-813F-4401-9A9F-29F7A576FA11}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00C4E345-813F-4401-9A9F-29F7A576FA11}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00C4E345-813F-4401-9A9F-29F7A576FA11}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00CA399E-4CC0-43D2-902B-CEA3D36DC9E4}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00CA399E-4CC0-43D2-902B-CEA3D36DC9E4}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00CA399E-4CC0-43D2-902B-CEA3D36DC9E4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00CA399E-4CC0-43D2-902B-CEA3D36DC9E4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\ManagedDefenderProductType
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00DA2F99-F2A6-40C2-B770-A920F8E44ABC}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\ManagedDefenderProductType
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00DA2F99-F2A6-40C2-B770-A920F8E44ABC}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00da2f99-f2a6-40c2-b770-a920f8e44abc}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\PassiveMode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\PassiveMode
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00eebf57-477d-4084-9921-7ab3c2c9459d}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00eebf57-477d-4084-9921-7ab3c2c9459d}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00f24ca0-748f-4e8a-894f-0e0357c6799f}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\Features
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\SenseEnabled
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00F26E02-E9F2-4A9F-9FDD-5A962FB26A98}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Defender\MpEngine
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00F26E02-E9F2-4A9F-9FDD-5A962FB26A98}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00f26e02-e9f2-4a9f-9fdd-5a962fb26a98}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Microsoft Antimalware\MpEngine
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00F29A34-B8A1-482C-BCF8-3AC7B0FE8F62}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00F29A34-B8A1-482C-BCF8-3AC7B0FE8F62}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00f29a34-b8a1-482c-bcf8-3ac7b0fe8f62}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00f29a34-b8a1-482c-bcf8-3ac7b0fe8f62}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00F2B433-44E4-4D88-B2B0-2698A0A91DBA}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00F2B433-44E4-4D88-B2B0-2698A0A91DBA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00f2b433-44e4-4d88-b2b0-2698a0a91dba}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{00F2CE1E-935E-4248-892C-130F32C45CB4}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F2CE1E-935E-4248-892C-130F32C45CB4}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0102563D-F16D-434D-82A2-37968BD3E31E}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0102563D-F16D-434D-82A2-37968BD3E31E}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0102563D-F16D-434d-82A2-37968BD3E31E}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0102563D-F16D-434d-82A2-37968BD3E31E}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{010911E2-F61C-479B-B08C-43E6D1299EFE}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{010911E2-F61C-479B-B08C-43E6D1299EFE}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{010911E2-F61C-479B-B08C-43E6D1299EFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{010911E2-F61C-479B-B08C-43E6D1299EFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{011B3619-FE63-4814-8A84-15A194CE9CE3}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{011B3619-FE63-4814-8A84-15A194CE9CE3}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{011B3619-FE63-4814-8A84-15A194CE9CE3}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{011BE22D-E453-11D1-945A-00C04FB984F9}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{011BE22D-E453-11D1-945A-00C04FB984F9}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0131BE10-2001-4C5F-A9B0-CC88FAB64CE8}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0131BE10-2001-4C5F-A9B0-CC88FAB64CE8}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0131BE10-2001-4C5F-A9B0-CC88FAB64CE8}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0131BE10-2001-4C5F-A9B0-CC88FAB64CE8}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0134A8B2-3407-4B45-AD25-E9F7C92A80BC}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0134A8B2-3407-4B45-AD25-E9F7C92A80BC}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0134A8B2-3407-4B45-AD25-E9F7C92A80BC}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{01458CF0-A1A2-11D1-8F85-00600895E7D5}
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{01458CF0-A1A2-11D1-8F85-00600895E7D5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{01458CF0-A1A2-11D1-8F85-00600895E7D5}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\ProductAppDataPath
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0149EEDF-D08F-4142-8D73-D23903D21E90}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{01575CFE-9A55-4003-A5E1-F38D1EBDCBE1}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager\AllowRealtimeMonitoring
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\ReadWriteTempFile
  • HKEY_CURRENT_USER\Software\Classes\*\ReadWriteTempFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\ReadWriteTempFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ReadWriteTempFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.exe_
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList\MRUList
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IsoBurn\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Notepad\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\drwatson.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\shscrap.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SeparatorBefore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ResolveLinksInvokeBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\InvokeCommandOnSelection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\OpenControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\OpenControlPanelPage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\AppUserModelID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\NoSmartScreen
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\LocalServerOnly
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\InProcServer32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E44E9428-BDBC-4987-A099-40DC8FD255E7} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4801A3-2BA9-11CF-A229-00AA003D7352}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C9CD5BB-98E9-4491-A60F-31AACC72B83C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85075ACF-231F-40EA-9610-D26B7B58F638}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18B21AA9-E184-4FF0-9F5E-F882D03771B3}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9D923EDC-B7A9-4F77-9933-284E7E2B2536}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1AF3A467-214F-4298-908E-06B03E0B39F9}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{667708D1-A931-4A85-9999-609EAA7DD85A}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\OpenWith.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\OpenWith.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D4C1E64-E410-4FAA-BAFA-59CA069BFEC2}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\NoStartPage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\IsHostApp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{880B26F8-9197-43D0-8045-8702D0D72000}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList\a
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D770B2AD-8F5E-4B8E-B3DF-F05A2AB5287C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{228826af-02e1-4226-a9e0-99a855e455a6}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37987DB6-9D85-4381-8D7D-3189661223D1}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37987DB6-9D85-4381-8D7D-3189661223D1}\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo\02091777-C187-951A-0E4E-E98CEC442EC9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D4D1EC2-4740-4FC5-B4B1-6DC3722A2EEB}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67136E8B-6914-43F0-8F25-05619927D22E}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\MRUList
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\SortOrderIndex
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\MRUList
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Rev
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Vid
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Mode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\IconSize
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Sort
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\ColInfo
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupCollapseState
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupView
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:FMTID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:PID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByDirection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\SystemIndexNormalization
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\PreviewDetails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\AppliesTo
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowPreviewHandlers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{ED9D80B9-D157-457B-9192-0E7280313BF0} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NoPreviousVersions
  • HKEY_CURRENT_USER\Software\Classes\*\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NoPreviousVersionsPage
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NoPreviousVersionsPage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NoSendTo
  • HKEY_CURRENT_USER\Software\Classes\*\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSendToMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DelaySendToMenuBuild
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrivesInSendToMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f3d06e7c-1e45-4a26-847e-f9fcdee59be0}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{e61bf828-5e63-4287-bef1-60b1a4fde0e3}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@sendmail.dll,-21
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@zipfldr.dll,-10148
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\System32\fsquirt.exe,-2343
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@sendmail.dll,-4
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-120
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99D353BC-C813-41ec-8F28-EAE61E702E57}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99D353BC-C813-41ec-8F28-EAE61E702E57}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{99d353bc-c813-41ec-8f28-eae61e702e57}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.LNK
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemPathDisplayNarrow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemFolderPathDisplayNarrow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SharingWizardOn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SharingWizardOn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInplaceSharing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoEncryption
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A470F8CF-A1E8-4f65-8335-227475AA5C46}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityStore\Providers\{D7F9888F-E3FC-49b0-9EA6-A85B5F392A4F}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2bf9676-5f8f-435c-97eb-11607a5bedf7}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2bf9676-5f8f-435c-97eb-11607a5bedf7}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{e2bf9676-5f8f-435c-97eb-11607a5bedf7}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2bf9676-5f8f-435c-97eb-11607a5bedf7}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\ExplorerCommandHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09A47860-11B0-4DA5-AFA5-26D86198A780}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09A47860-11B0-4DA5-AFA5-26D86198A780}\InprocServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{09a47860-11b0-4da5-afa5-26d86198a780}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{09A47860-11B0-4DA5-AFA5-26D86198A780} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{470C0EBD-5D73-4d58-9CED-E91E22E23282}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{470C0EBD-5D73-4d58-9CED-E91E22E23282}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86C86720-42A0-1069-A2E8-08002B30309D}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86C86720-42A0-1069-A2E8-08002B30309D}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86C86720-42A0-1069-A2E8-08002B30309D}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86C86720-42A0-1069-A2E8-08002B30309D}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{470C0EBD-5D73-4d58-9CED-E91E22E23282}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoChangeStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\PolicyType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\System32\fsquirt.exe.FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\Behavior
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\System32\fsquirt.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UserState\UserStateTechnologies\ConfigurationControls\OfflineFiles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B8CDCB65-B1BF-4B42-9428-1DFDB7EE92AF} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.zfsendtotarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ZFSendToTarget\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ZFSendToTarget\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\ShellEx\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{888dca60-fc0a-11cf-8f0f-00c04fd7d062}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SeparatorBefore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SeparatorAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\MUIVerb
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@windows.storage.dll,-8517
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SeparatorBefore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SeparatorAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ShowAsDisabledIfHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\NoStaticDefaultVerb
  • HKEY_CURRENT_USER\Software\Classes\*\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\MultiSelectModel
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LegacyPlayerInvokeLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LegacyPlayerInvokeLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\MUIVerb
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@efscore.dll,-101
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\AttributeMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\AttributeValue
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ShowAsDisabledIfHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.desklink
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.desklink\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.desklink\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.desklink\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.DeskLink
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\shellex\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{9e56be61-c50f-11cf-9a2c-00a0c90a90ce}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.mydocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mydocs\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mydocs\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mydocs\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.mydocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\shellex\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ecf03a32-103d-11d2-854d-006008059367}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{ECF03A32-103D-11D2-854D-006008059367} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersLibraries\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersLibraries\NameSpace\MonitorRegistry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.library-ms
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.library-ms\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.library-ms\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\ShellEx\IconHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.library-ms\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\FolderValueFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsParseDisplayName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\QueryForInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\EnableThumbnails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\NoDefaultToFS
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\ParseDisplayNameNeedsURL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\BlockNewFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\NoInitRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\SafeRootForMTA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsSendToTarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\NoLocalizedNameInTarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{A5A3563A-5755-4A6F-854E-AFA3230B199F}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@windows.storage.dll,-34575
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\ShellEx\LibraryDescriptionHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\EnableShareDenyNone
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000103-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DefaultDropEffect
  • HKEY_CURRENT_USER\Software\Classes\*\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\{BD472F60-27FA-11cf-B8B4-444553540000}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\WFS.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\WFS.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.mapimail
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mapimail\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mapimail\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mapimail\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.MAPIMail
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\shellex\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{9e56be60-c50f-11cf-9a2c-00a0c90a90ce}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder\RDPNP
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder\LanmanWorkstation
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder\webclient
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPNP\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPNP\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPNP\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@windows.storage.dll,-21825
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Media.Streaming.DeviceController
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{9113a02d-00a3-46b9-bc5f-9c04daddd5d7}\InProcServer32
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000404C0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\windows.storage.dll,-50691
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{bd472f60-27fa-11cf-b8b4-444553540000}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{BD472F60-27FA-11CF-B8B4-444553540000} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ExtractionWizard
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ExtractionWizard\ShowFiles
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\1
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\1\MRUList
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\1\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\1\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\SniffedFolderType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Shell.Holographic.ContextIdentifier
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Shell.Popups.PopupClient
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock
  • HKEY_CURRENT_USER\Software\Microsoft\Direct3D
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Direct3D
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Composition.Compositor
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\MUI\Settings
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Control Panel\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Activation.Private.ApplicationActivationProperties
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.PrimaryTileUserChangedEventArgs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.PackageLocation
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Cortana
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Cortana\IsAvailable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Package
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Core.CoreWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Activation.Private.ApplicationActivation
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithProgids\WMP11.AssocFile.3G2
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithProgids\WMP11.AssocFile.3GP
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithProgids\WMP11.AssocFile.3G2
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithProgids\WMP11.AssocFile.3GP
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\OpenWithProgids\WMP11.AssocFile.ADTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adt\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adt\OpenWithProgids\WMP11.AssocFile.ADTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adts\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adts\OpenWithProgids\WMP11.AssocFile.ADTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithProgids\WMP11.AssocFile.AIFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithProgids\WMP11.AssocFile.AIFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithProgids\WMP11.AssocFile.AIFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithProgids\WMP11.AssocFile.ASF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithProgids\WMP11.AssocFile.ASX
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithProgids\WMP11.AssocFile.AU
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithProgids\WMP11.AssocFile.AVI
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids\Paint.Picture
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab\OpenWithProgids\CABFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cdxml\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cdxml\OpenWithProgids\Microsoft.PowerShellCmdletDefinitionXML.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.css\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.css\OpenWithProgids\CSSfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dds\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dds\OpenWithProgids\ddsfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithProgids\Paint.Picture
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dll\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dll\OpenWithProgids\dllfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx\OpenWithProgids\docxfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\OpenWithProgids\emffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\OpenWithProgids\WMP11.AssocFile.FLAC
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fon\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fon\OpenWithProgids\fonfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithProgids\giffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithProgids\htmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids\htmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithProgids\icofile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inf\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inf\OpenWithProgids\inffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini\OpenWithProgids\inifile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithProgids\pjpegfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithProgids\jpegfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithProgids\jpegfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithProgids\jpegfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jxr\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jxr\OpenWithProgids\wdpfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\OpenWithProgids\lnkfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2t\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2t\OpenWithProgids\WMP11.AssocFile.M2TS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\OpenWithProgids\WMP11.AssocFile.M2TS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2v\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithProgids\WMP11.AssocFile.m3u
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithProgids\WMP11.AssocFile.M4A
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithProgids\WMP11.AssocFile.MP4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithProgids\mhtmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithProgids\mhtmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithProgids\WMP11.AssocFile.MIDI
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\OpenWithProgids\WMP11.AssocFile.MIDI
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mk3d\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mk3d\OpenWithProgids\WMP11.AssocFile.MK3D
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mka\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mka\OpenWithProgids\WMP11.AssocFile.MKA
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mkv\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mkv\OpenWithProgids\WMP11.AssocFile.MKV
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mod\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mod\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithProgids\WMP11.AssocFile.MOV
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MP2\OpenWithProgids\WMP11.AssocFile.MP3
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithProgids\WMP11.AssocFile.MP3
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithProgids\WMP11.AssocFile.MP4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithProgids\WMP11.AssocFile.MP4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MPE\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\OpenWithProgids\WMP11.AssocFile.M2TS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ocx\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ocx\OpenWithProgids\ocxfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odt\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odt\OpenWithProgids\odtfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.otf\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.otf\OpenWithProgids\otffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithProgids\pngfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1\OpenWithProgids\Microsoft.PowerShellScript.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1xml\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1xml\OpenWithProgids\Microsoft.PowerShellXMLData.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd1\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd1\OpenWithProgids\Microsoft.PowerShellData.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psm1\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psm1\OpenWithProgids\Microsoft.PowerShellModule.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pssc\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pssc\OpenWithProgids\Microsoft.PowerShellSessionConfiguration.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\OpenWithProgids\rlefile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithProgids\WMP11.AssocFile.MIDI
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf\OpenWithProgids\rtffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.scf\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.scf\OpenWithProgids\SHCmdFile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.search-ms\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.search-ms\OpenWithProgids\SearchFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithProgids\WMP11.AssocFile.AU
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sys\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sys\OpenWithProgids\sysfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithProgids\TIFImage.Document
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithProgids\TIFImage.Document
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ts\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithProgids\WMP11.AssocFile.TTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\OpenWithProgids\ttcfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\OpenWithProgids\ttffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tts\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithProgids\WMP11.AssocFile.TTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids\txtfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithProgids\WMP11.AssocFile.WAV
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\OpenWithProgids\WMP11.AssocFile.WAX
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithProgids\wdpfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithProgids\WMP11.AssocFile.ASF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithProgids\WMP11.AssocFile.WMA
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\OpenWithProgids\wmffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithProgids\WMP11.AssocFile.WMV
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\OpenWithProgids\WMP11.AssocFile.ASX
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WPL\OpenWithProgids\WMP11.AssocFile.WPL
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithProgids\WMP11.AssocFile.WVX
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithProgids\xmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xsl\OpenWithProgids
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xsl\OpenWithProgids\xslfile
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\TraySearchBoxVisible
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\TraySearchBoxVisibleOnAnyMonitor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Storage.Cloud.CloudStore
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched\PythonSoftwareFoundation.PythonManager_3847v3x7pw1km!Python.Exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Internal.UserActivities.UserActivityHistoryPayload
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Calendar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Json.JsonObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Json.JsonValue
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch\Chrome
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000305D2
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Puebzr
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated\Chrome
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked\StartButton
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\UBR
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\DisplayVersion
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\Windows NT Access Provider
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\Windows NT Access Provider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\RequireUniqueAccessibility
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\
  • HKEY_LOCAL_MACHINE\Software\Google\Update\ClientStateMedium\
  • HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\usagestats
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\AllowDevelopmentWithoutDevLicense
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense
  • HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseActivationAuthenticationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\updater.exe
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1588C1A8-27D9-563E-9641-8D20767FB258}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{1588C1A8-27D9-563E-9641-8D20767FB258}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{85AE4AE3-8530-516B-8BE4-A456BF2637D3}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{B16B5A0E-3B72-5223-8DF0-9117CD64DE77}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{B7FD5390-D593-5A8B-9AE2-23CE39822FD4}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{699F07AD-304C-5F71-A2DA-ABD765965B54}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{699F07AD-304C-5F71-A2DA-ABD765965B54}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F258BE54-7C5F-44A0-AAE0-730620A31D23}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{F258BE54-7C5F-44A0-AAE0-730620A31D23}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{E9CD91E3-A00C-4B9E-BD63-7F34EB815D98}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{5F793925-C903-4E92-9AE3-77CA5EAB1716}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{5F793925-C903-4E92-9AE3-77CA5EAB1716}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{C4622B28-A747-44C7-96AF-319BE5C3B261}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{C4622B28-A747-44C7-96AF-319BE5C3B261}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{D576ED7F-31DA-4EE1-98CE-1F882FB3047A}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{1F1289FD-DD10-4579-81F6-1C59AAF2E1A9}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{B685B009-DBC4-4F24-9542-A162C3793E77}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{B685B009-DBC4-4F24-9542-A162C3793E77}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{513BC7DA-6B8D-45F7-90A0-2E9F66CEF962}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F4334319-8210-469B-8262-DD03623FEB5B}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{F4334319-8210-469B-8262-DD03623FEB5B}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F966A529-43C6-4710-8FF4-0B456324C8F4}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{F966A529-43C6-4710-8FF4-0B456324C8F4}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{4DC034A8-4BFC-4D43-9250-914163356BB0}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{4DC034A8-4BFC-4D43-9250-914163356BB0}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{F4FE76BC-62B9-49FC-972F-C81FC3A926DB}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{6430040A-5EBD-4E63-A56F-C71D5990F827}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{6430040A-5EBD-4E63-A56F-C71D5990F827}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{DD42475D-6D46-496A-924E-BD5630B4CBBA}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{8476CE12-AE1F-4198-805C-BA0F9B783F57}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{34527502-D3DB-4205-A69B-789B27EE0414}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{34527502-D3DB-4205-A69B-789B27EE0414}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{05A30352-EB25-45B6-8449-BCA7B0542CE5}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{05A30352-EB25-45B6-8449-BCA7B0542CE5}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{27634814-8E41-4C35-8577-980134A96544}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{27634814-8E41-4C35-8577-980134A96544}
  • HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\brand
  • HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\brand
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\brand
  • HKEY_LOCAL_MACHINE\Software\Google\Enrollment\
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Provisioning\OMADM\Accounts
  • HKEY_USERS\.DEFAULT\Software\Microsoft\Provisioning\OMADM\Accounts
  • HKEY_LOCAL_MACHINE\Software\Policies\Google\Update\
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32\DiagMatchAnyMask
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Sorting\Ids
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\My\PhysicalStores
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\My
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\CRLs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\CTLs
  • HKEY_USERS
  • HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\My\PhysicalStores
  • HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\My
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\InprocHandler
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
  • HKEY_CLASSES_ROOT\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\AppID
  • HKEY_CURRENT_USER\Software\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\AuthenticationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\AccessPermission
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocHandler
  • HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\Software\Classes\Unmarshalers\System\{00000338-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\Interface\{91D01F44-11D0-4F2B-B516-757A456F47B1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91D01F44-11D0-4F2B-B516-757A456F47B1}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91D01F44-11D0-4F2B-B516-757A456F47B1}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\Elevation
  • HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsRuntime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\Diagnosis
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocServer32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Containers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Containers\WaitForRestore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\Interface\{DF8E9480-CA73-448E-B8F0-DA000F581428}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF8E9480-CA73-448E-B8F0-DA000F581428}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF8E9480-CA73-448E-B8F0-DA000F581428}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\Interface\{DCAEE35A-508D-4419-9E56-50D658C2C812}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAEE35A-508D-4419-9E56-50D658C2C812}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAEE35A-508D-4419-9E56-50D658C2C812}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{FA79A0EC-8AC2-40DB-A299-E5772593C226}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{0000000C-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
  • HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
  • HKEY_CURRENT_USER\Software\Classes\AppID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalService
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\DllSurrogate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\RunAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ActivateAtStorage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ROTFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AppIDFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\MGOTFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ProcessMitigationPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LaunchPermission
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AuthenticationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\RemoteServerName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\SRPTrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\PreferredServerBitness
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LoadUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ProtectionLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AccessPermission
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\GipActivityBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\Interface\{75121952-E0D0-43E5-9380-1D80483ACF72}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75121952-e0d0-43e5-9380-1d80483acf72}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75121952-e0d0-43e5-9380-1d80483acf72}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{E44E9428-BDBC-4987-A099-40DC8FD255E7}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\InprocServer32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\InprocHandler
  • HKEY_CURRENT_USER\Software\Classes\AppID\OpenWith.exe
  • HKEY_CURRENT_USER\Software\Classes\Interface\{7F9185B0-CB92-43C5-80A9-92277A4F7B54}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F9185B0-CB92-43C5-80A9-92277A4F7B54}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F9185B0-CB92-43C5-80A9-92277A4F7B54}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{FC4801A3-2BA9-11CF-A229-00AA003D7352}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4801A3-2BA9-11CF-A229-00AA003D7352}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\Interface\{1C9CD5BB-98E9-4491-A60F-31AACC72B83C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C9CD5BB-98E9-4491-A60F-31AACC72B83C}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{85075ACF-231F-40EA-9610-D26B7B58F638}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85075ACF-231F-40EA-9610-D26B7B58F638}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{18B21AA9-E184-4FF0-9F5E-F882D03771B3}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18B21AA9-E184-4FF0-9F5E-F882D03771B3}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{6D5140C1-7436-11CE-8034-00AA006009FA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D5140C1-7436-11CE-8034-00AA006009FA}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D5140C1-7436-11CE-8034-00AA006009FA}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\Interface\{9D923EDC-B7A9-4F77-9933-284E7E2B2536}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9D923EDC-B7A9-4F77-9933-284E7E2B2536}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\Interface\{00000114-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000114-0000-0000-C000-000000000046}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000114-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{1AF3A467-214F-4298-908E-06B03E0B39F9}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1AF3A467-214F-4298-908E-06B03E0B39F9}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{667708D1-A931-4A85-9999-609EAA7DD85A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{667708D1-A931-4A85-9999-609EAA7DD85A}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_CLASSES_ROOT\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\ShellFolder\FolderValueFlags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{59031A47-3F72-44A7-89C5-5595FE6B30EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PropertyBag
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3968686040-3210279463-847977608-1001
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3968686040-3210279463-847977608-1001\ProfileImagePath
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KnownFolderSettings
  • HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Data
  • HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
  • HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Data
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Generation
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PropertyBag
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PropertyBag
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ExePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\CommandLine
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\IdentityType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ActivatableClasses
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ServerType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\AppId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\Identity
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ServiceName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ExplicitPsmActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\CustomAttributes
  • HKEY_CURRENT_USER\Software\Classes\Interface\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\Interface\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{89BC3F49-F8D9-5103-BA13-DE497E609167}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.exe_
  • HKEY_CLASSES_ROOT\.exe_
  • HKEY_CLASSES_ROOT\.exe_\OpenWithProgids
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\UserChoice
  • HKEY_CLASSES_ROOT\Unknown
  • HKEY_CURRENT_USER\Software\Classes\Unknown\ShellEx\PropertyHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\ShellEx\PropertyHandler
  • HKEY_CLASSES_ROOT\SystemFileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NoOpenWith
  • HKEY_CURRENT_USER\Software\Classes\*\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoOpenWith
  • HKEY_CURRENT_USER\Software\Classes\Interface\{4D4C1E64-E410-4FAA-BAFA-59CA069BFEC2}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D4C1E64-E410-4FAA-BAFA-59CA069BFEC2}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{880B26F8-9197-43D0-8045-8702D0D72000}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{880B26F8-9197-43D0-8045-8702D0D72000}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{D770B2AD-8F5E-4B8E-B3DF-F05A2AB5287C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D770B2AD-8F5E-4B8E-B3DF-F05A2AB5287C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Scaling
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\DUIScaling
  • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FontCache\Parameters
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FontCache\Parameters\ClientCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Avalon.Graphics
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Avalon.Graphics
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Avalon.Graphics\DISPLAY1
  • HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityManager\TransientObjects\%5C%5C.%5CRpc%5CAllowLpacAppExperience%5CInterface
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\TransientObjects\%5C%5C.%5CRpc%5CAllowLpacAppExperience%5CInterface\SecurityDescriptor
  • HKEY_CURRENT_USER\Software\Microsoft\DirectX\UserGpuPreferences
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\GraphicsDrivers
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Dwm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Dwm\DisallowNonDrawListRendering
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Personalization
  • HKEY_CLASSES_ROOT\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Microsoft\Accessibility
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Accessibility\TextScaleFactor
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithProgids
  • HKEY_CLASSES_ROOT\.exe_\OpenWithList
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\FileAssociations\.exe_
  • HKEY_CLASSES_ROOT\Applications\dsquery.dll
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Applications\iexplore.exe
  • HKEY_LOCAL_MACHINE\Software\Classes\Applications\iexplore.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\ApplicationCompany
  • HKEY_CURRENT_USER_LOCAL_SETTINGS\
  • HKEY_CURRENT_USER_LOCAL_SETTINGS\Software\Microsoft\Windows\Shell\MuiCache
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\LangID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Internet Explorer\iexplore.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Internet Explorer\iexplore.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Max Cached Icons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
  • HKEY_CLASSES_ROOT\CLSID\{AC757296-3522-4E11-9862-C17BE5A1767E}\Instance
  • HKEY_CLASSES_ROOT\CLSID\{2B46E70F-CDA7-473E-89F6-DC9630A2390B}\Instance
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ImmersiveShell\Grid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Applications\mspaint.exe
  • HKEY_LOCAL_MACHINE\Software\Classes\Applications\mspaint.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\mspaint.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\mspaint.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_CLASSES_ROOT\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\OverrideFileSystemProperties
  • HKEY_CLASSES_ROOT\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}
  • HKEY_CLASSES_ROOT\ExplorerCLSIDFlags\{66742402-F9B9-11D1-A202-0000F81FEDEE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{66742402-F9B9-11D1-A202-0000F81FEDEE}
  • HKEY_CLASSES_ROOT\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\PropertyBag
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Applications\NOTEPAD.EXE
  • HKEY_LOCAL_MACHINE\Software\Classes\Applications\NOTEPAD.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\NOTEPAD.EXE.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\NOTEPAD.EXE.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.EXE
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\FriendlyAppName
  • HKEY_LOCAL_MACHINE\Software\Classes\Applications\wmplayer.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@wmploc.dll,-102
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files (x86)\Windows Media Player\wmplayer.exe.ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files (x86)\Windows Media Player\wmplayer.exe.FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Applications\WORDPAD.EXE
  • HKEY_LOCAL_MACHINE\Software\Classes\Applications\WORDPAD.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.FriendlyAppName
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsStore
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\WindowsStore
  • HKEY_CLASSES_ROOT\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\ms-windows-store\URL Protocol
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\UrlAssociations
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\UrlAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\UrlAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-windows-store\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppModel\StateChange\PackageList\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\PackageStatus
  • HKEY_CLASSES_ROOT\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\URL Protocol
  • HKEY_LOCAL_MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\ms-windows-store
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\ms-windows-store\UserChoice
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\CurVer
  • HKEY_LOCAL_MACHINE\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\CurVer
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\AppUserModelID
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Application
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Application\AppUserModelID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1E87508D-89C2-42F0-8A7E-645A0F50CA58}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\PropertyBag
  • HKEY_CLASSES_ROOT\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\SortOrderIndex
  • HKEY_CLASSES_ROOT\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\ShellFolder\FolderValueFlags
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}\ShellFolder
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{4234D49B-0245-4DF3-B780-3893943456E1}\ShellFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{4234D49B-0245-4DF3-B780-3893943456E1}
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{4234D49B-0245-4DF3-B780-3893943456E1}
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{4234D49B-0245-4DF3-B780-3893943456E1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\PreXPSP2ShellProtocolBehavior
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\LogFlags
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4234D49B-0245-4DF3-B780-3893943456E1} {000214E6-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\
  • HKEY_CURRENT_USER\Control Panel\International\User Profile
  • HKEY_CURRENT_USER\Control Panel\International\User Profile\Languages
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\Interface\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{5232F8EA-49C7-4840-BFBB-66E785689E88}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5232f8ea-49c7-4840-bfbb-66e785689e88}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5232f8ea-49c7-4840-bfbb-66e785689e88}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\CustomAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\Interface\{E3DD5D31-892E-4AD6-9CE9-8FE1F185047B}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e3dd5d31-892e-4ad6-9ce9-8fe1f185047b}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e3dd5d31-892e-4ad6-9ce9-8fe1f185047b}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{6A905A4B-CD66-5C7C-AB57-F5EB16C97257}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6a905a4b-cd66-5c7c-ab57-f5eb16c97257}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6a905a4b-cd66-5c7c-ab57-f5eb16c97257}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{2BE22368-4C98-5E9F-AC2B-DE493C0C3E43}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2be22368-4c98-5e9f-ac2b-de493c0c3e43}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2be22368-4c98-5e9f-ac2b-de493c0c3e43}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{F502008F-7A0E-5757-8E65-EBAD2E5A0E21}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{f502008f-7a0e-5757-8e65-ebad2e5a0e21}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{f502008f-7a0e-5757-8e65-ebad2e5a0e21}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{19AD9E30-89F3-48F6-9C50-E34A59494544}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19ad9e30-89f3-48f6-9c50-e34a59494544}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19ad9e30-89f3-48f6-9c50-e34a59494544}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{8A43ED9F-F4E6-4421-ACF9-1DAB2986820C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8a43ed9f-f4e6-4421-acf9-1dab2986820c}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8a43ed9f-f4e6-4421-acf9-1dab2986820c}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\Interface\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{195F5943-0C04-4EAB-B907-735817FDAC77}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{195f5943-0c04-4eab-b907-735817fdac77}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{195f5943-0c04-4eab-b907-735817fdac77}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageExternalLocation\Index\UserAndPackage\3^90
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageExternalLocation\Index\UserAndPackage\0^90
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\InstalledLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\MutableLink
  • HKEY_CURRENT_USER\Software\Classes\Interface\{1B0D3570-0877-5EC2-8A2C-3B9539506ACA}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1b0d3570-0877-5ec2-8a2c-3b9539506aca}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1b0d3570-0877-5ec2-8a2c-3b9539506aca}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\PackageOrigin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\PackageFullName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\PackageFamily
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\PackageType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\Flags2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\Volume
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\OSMaxVersionTested
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\MutableLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\TargetDeviceFamilyName
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\OEM\DeviceForm
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\Microsoft.WindowsStore_8wekyb3d8bbwe\ResourcesConfig
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\ResourcesConfig\CachedMergedResourcesPriFileName
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Mrt
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\ResourcesConfig\Language
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Microsoft.WindowsStore_8wekyb3d8bbwe
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Microsoft.WindowsStore_8wekyb3d8bbwe\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Microsoft.WindowsStore_8wekyb3d8bbwe\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Flags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Microsoft.WindowsStore_8wekyb3d8bbwe\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Microsoft.WindowsStore_8wekyb3d8bbwe\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Flags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\ResourcesConfig\ManifestLanguagesList
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\ResourcesConfig\OverrideLanguagesList
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableThumbnails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThumbnailCache
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{44705F64-F07C-4AB6-B790-EA4CBDD2CF66}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\AppID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\Elevation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HVSI
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Hvsi\UIAutomationIsInRemoteOnlySession
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\DUITouchScrollViewerTiling
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AlwaysAllowCache
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\DirectManipulation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\OpenWith.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\EnableAnchorContext
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\Compatibility\AppCompatClassName
  • HKEY_CURRENT_USER\Software\Classes\Interface\{B849ACB5-8AC5-4FB8-88B6-55C749D25A44}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B849ACB5-8AC5-4FB8-88B6-55C749D25A44}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B849ACB5-8AC5-4FB8-88B6-55C749D25A44}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{8D4D1EC2-4740-4FC5-B4B1-6DC3722A2EEB}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D4D1EC2-4740-4FC5-B4B1-6DC3722A2EEB}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Appx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepositoryRoot
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\Parameters\RpcCacheTimeout
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Security\RunBinaryControlHostProcessInSeparateAppContainer
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\RunBinaryControlHostProcessInSeparateAppContainer
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_CLASSES_ROOT\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance\{41945702-8302-44A6-9445-AC98E8AFA086}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance\{41945702-8302-44A6-9445-AC98E8AFA086}\CLSID
  • HKEY_CLASSES_ROOT\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Author
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\FriendlyName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SpecVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Vendor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\ContainerFormat
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\DeviceManufacturer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\DeviceModels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\ColorManagementVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\MimeTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\FileExtensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SupportAnimation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SupportChromakey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SupportLossless
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SupportMultiframe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\ArbitrationPriority
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Formats
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\CLSID
  • HKEY_CLASSES_ROOT\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Author
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\FriendlyName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SpecVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Vendor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\ContainerFormat
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\DeviceManufacturer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\DeviceModels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\ColorManagementVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\MimeTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\FileExtensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SupportAnimation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SupportChromakey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SupportLossless
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SupportMultiframe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\ArbitrationPriority
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Formats
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F42EE2D3-909F-4907-8871-4C22FC0BF756}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{F42EE2D3-909F-4907-8871-4C22FC0BF756}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A0C69A99-21C8-4671-8703-7934162FCF1D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{A0C69A99-21C8-4671-8703-7934162FCF1D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0DDD015D-B06C-45D5-8C4C-F59713854639}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{0DDD015D-B06C-45D5-8C4C-F59713854639}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7D83EE9B-2244-4E70-B1F5-5393042AF1E4}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{7D83EE9B-2244-4E70-B1F5-5393042AF1E4}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435F-B3D9-28DAA648C0F6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\PropertyBag
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{A52BBA46-E9E1-435F-B3D9-28DAA648C0F6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PropertyBag
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\IdListAliasTranslations
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\IdListAliasTranslations
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.png
  • HKEY_CLASSES_ROOT\.png
  • HKEY_CURRENT_USER\Software\Classes\.png\Content Type
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\ShellEx\IconHandler
  • HKEY_CLASSES_ROOT\SystemFileAssociations\.png
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx\IconHandler
  • HKEY_CLASSES_ROOT\SystemFileAssociations\image
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\ShellEx\IconHandler
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\DocObject
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\Clsid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\Clsid
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\Clsid
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\AlwaysShowExt
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\NeverShowExt
  • HKEY_CURRENT_USER\Software\Classes\Interface\{4CC8FE6A-5976-4ECE-AC32-62E2A5497F46}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4cc8fe6a-5976-4ece-ac32-62e2a5497f46}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4cc8fe6a-5976-4ece-ac32-62e2a5497f46}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{E78F846C-10BC-4153-9BB5-5B30018E31F2}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e78f846c-10bc-4153-9bb5-5b30018e31f2}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e78f846c-10bc-4153-9bb5-5b30018e31f2}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CURRENT_USER\Software\Classes\.png\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\Software\Classes\.png\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\.png\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_CURRENT_USER\Software\Classes\SystemFileAssociations\image\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\{e357fccd-a995-4576-b01f-234630154e96}\(Default)
  • HKEY_CLASSES_ROOT\CLSID\{C7657C4A-9F68-40FA-A4DF-96BC08EB3551}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\NoOplock
  • HKEY_CLASSES_ROOT\ExplorerCLSIDFlags\{C7657C4A-9F68-40FA-A4DF-96BC08EB3551}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\UseOutOfProcHandlerCache
  • HKEY_CLASSES_ROOT\CLSID\{C7657C4A-9F68-40FA-A4DF-96BC08EB3551}\Instance
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C7657C4A-9F68-40FA-A4DF-96BC08EB3551}\InProcServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{c7657c4a-9f68-40fa-a4df-96bc08eb3551}\InProcServer32
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C7657C4A-9F68-40FA-A4DF-96BC08EB3551} {E357FCCD-A995-4576-B01F-234630154E96} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{C7657C4A-9F68-40FA-A4DF-96BC08EB3551}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\EnableShareDenyNone
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\DisableFCM
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FCM\Impolite
  • HKEY_CURRENT_USER\Software\Classes\Interface\{67136E8B-6914-43F0-8F25-05619927D22E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67136E8B-6914-43F0-8F25-05619927D22E}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\channel
  • HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\ap
  • HKEY_LOCAL_MACHINE\Software\WOW6432Node\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\cohort
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\name
  • HKEY_USERS\.DEFAULT\Control Panel\International
  • HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
  • HKEY_USERS\.DEFAULT\Control Panel\International\sList
  • HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
  • HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
  • HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
  • HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
  • HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
  • HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
  • HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
  • HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
  • HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
  • HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
  • HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
  • HKEY_USERS\.DEFAULT\Control Panel\International\s1159
  • HKEY_USERS\.DEFAULT\Control Panel\International\s2359
  • HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
  • HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
  • HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
  • HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
  • HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
  • HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
  • HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
  • HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
  • HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
  • HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
  • HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
  • HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
  • HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
  • HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
  • HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
  • HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
  • HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
  • HKEY_USERS\.DEFAULT\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d
  • HKEY_USERS\.DEFAULT\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Currencies
  • HKEY_USERS\.DEFAULT\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Calendar
  • HKEY_USERS\.DEFAULT\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Gregorian
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-AU
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-AU
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-AU
  • HKEY_LOCAL_MACHINE\Software\Classes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\elevation_service.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\Forward
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0\0\win64
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\UDTAlignmentPolicy
  • HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
  • HKEY_LOCAL_MACHINE\System\CurrentControlset\Control\Lsa
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\LsaPid
  • HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Cryptography\Providers\Microsoft Software Key Storage Provider\UM\00010001
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cryptography\Providers\Microsoft Software Key Storage Provider\UM\00010001\Flags
  • HKEY_LOCAL_MACHINE\Software\Google\Chrome\Enrollment\
  • HKEY_CURRENT_USER\Software\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\(Default)
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler32
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\AppID
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\Elevation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\Elevation
  • HKEY_CURRENT_USER\Software\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\Forward
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\Forward
  • HKEY_CURRENT_USER\Software\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\TypeLib
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\TypeLib\Version
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}\1.0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}\1.0
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}\1.0\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}\1.0\0
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}\1.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}\1.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}\1.0\0\win32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\TypeLib
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\ProxyStubClsid32
  • HKEY_CURRENT_USER\Software\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\Forward
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\Forward
  • HKEY_CURRENT_USER\Software\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\TypeLib
  • HKEY_LOCAL_MACHINE\Software\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\TypeLib
  • HKEY_CURRENT_USER\Software\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\TypeLib\Version
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}
  • HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\1.0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\1.0
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\1.0\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\1.0\0
  • HKEY_CURRENT_USER\Software\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\1.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\1.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}\TreatAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}\InprocHandler32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}\InprocHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\Forward
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\Forward
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\Forward
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\Forward
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\1.0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\1.0\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\1.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\Forward
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\OemInstallTime
  • HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\pv
  • HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\DayOfLastActivity
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\DayOfLastRollCall
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\DayOfInstall
  • HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}\cohort
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\hint
  • HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\pv
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\ap
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\DayOfLastActivity
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\DayOfLastRollCall
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\DayOfInstall
  • HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\name
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\hint
  • HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\pv
  • HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{8a69d345-d564-463c-aff1-a69d9e530f96}
  • HKEY_LOCAL_MACHINE\Software\Policies\Google\CloudManagement\
  • EnrollmentToken
  • HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\
  • CloudManagementEnrollmentToken
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\CloudManagementEnrollmentToken
  • HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{430fd4d0-b729-4f61-aa34-91526481799d}
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{430fd4d0-b729-4f61-aa34-91526481799d}\CloudManagementEnrollmentToken
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85CB6900-4D95-11CF-960C-0080C7F4EE85}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.AppUserModel.ID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{9F4C2855-9F79-4B39-A8D0-E1D42DE1D5F3} 5
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\MonitorRegistry
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).x
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MinPos1920x1080x96(1).y
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1920x1080x96(1).x
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\MaxPos1920x1080x96(1).y
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).left
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).top
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).right
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WinPos1920x1080x96(1).bottom
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HubMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RetailDemo\OobeWrite\Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE\LaunchUserOOBE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\IsVailContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\ResyncResetTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Input\MaxResyncAttempts
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes\Segoe UI
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\Extensions\DragDropExtension
  • HKEY_CURRENT_USER\Control Panel\Desktop\CaretWidth
  • HKEY_CURRENT_USER\Control Panel\Desktop\CursorBlinkRate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\LanguagePack\SurrogateFallback\Plane2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Globalization.Language\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\Client\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\FolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\FolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\SniffedFolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AlwaysShowMenus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AlwaysShowMenus
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\MenuUserExpanded
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.UserProfile.UserProfileEngagementManager\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Authentication.Web.Core.WebAuthenticationCoreManager\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Uri\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.Authentication.Web.TokenBrokerInternal\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ExePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\CommandLine
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\IdentityType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ActivatableClasses
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ServerType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\AppId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\Identity
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ServiceName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\TokenBroker\ExplicitPsmActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountSignInAssistant\Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Accounts\AllowMicrosoftAccountConnection\Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\AttributeMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\AttributeValue
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ShowAsDisabledIfHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\AttributeMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ShowAsDisabledIfHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\MaxDownloadFileSize
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon\QatItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\AttributeMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\AttributeValue
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ShowAsDisabledIfHidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon\MinimizedStateTabletModeOff
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\SortOrderIndex
  • HKEY_CURRENT_USER\Control Panel\International\Geo\Nation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\ActivePolicyCode
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\OneDriveFRECompleted
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\FullRowSelect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\FullRowSelect
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ServerAdminUI
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\SortOrderIndex
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupCollapseState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32\ThreadingModel
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\PrefetchAbove
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\PrefetchAbove
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\PrefetchBelow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\PrefetchBelow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowFrequent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowFrequent
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowRecent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowRecent
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\grouppolicypath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\grouppolicyismultisz
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\grouppolicymultiszSeparatorChar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\HideRecentJumplists\Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecentDocsHistory
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowEncryptCompressedColor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\DelegateFolders\StorageDelegateSuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HomeFolderDesktop\NameSpace\DelegateFolders\StorageDelegate
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NavPaneShowAllCloudStates
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E5AAE11-A475-4c5b-AB00-C66DE400274E}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Generation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\GlobalSettings\ProperTreeModuleInner\ProperTreeModuleInner
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowStatusBar
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSyncProviderNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSyncProviderNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.PropList.StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{26DC287C-6E3D-4BD3-B2B0-6A26BA2E346D} 4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\LaunchTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\LaunchTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.LibraryLocationsCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{908696C7-8F87-44F2-80ED-A8C1C6894575} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.Sync.ItemState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{7BD5533E-AF15-44DB-B8C8-BD6624E1D032} 25
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\ShellFolder\DisableContextualTabset
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShowPidInTitle
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PropertyBag\BaseFolderId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\RDVirtualizationPool
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PropertyBag\BaseFolderId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane\ExpandedState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{5D76B67F-9B3D-44BB-B6AE-25DA4F638A67} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\{5D76B67F-9B3D-44BB-B6AE-25DA4F638A67} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\MonitorRegistry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders\StorageDelegateSuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52205fd8-5dfb-447d-801a-d0b52f2e83e1}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\DWM\ColorPrevalence
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\HeadlinesOnboardingComplete
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\ShellFeedsTaskbarViewMode
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\IsFeedsAvailable
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ImmersiveShell\TabletMode
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\ShellFeedsTaskbarContentUpdateMode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\{5D76B67F-9B3D-44BB-B6AE-25DA4F638A67} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2F6CE85C-F9EE-43CA-90C7-8A9BD53A2467}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64693913-1c21-4f30-a98f-4e52906d3b56}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{89D83576-6BD1-4c86-9454-BEB04E94C819}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9343812e-1c37-4a49-a12e-4b2d810d956b}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a00ee528-ebd9-48b8-944a-8942113d46ac}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{daf95313-e44d-46af-be1b-cbacea2c3065}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e345f35f-9397-435c-8f95-4e922c26259e}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f8278c54-a712-415b-b593-b77a2be0dda9}\SortOrderIndex
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\DescriptionID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\HelpTopic
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\HideNonRemovableDrives
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\UseRemovableStorageRegPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\UseRemovableDrivesRegPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\NoDelegateSearchRoot
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\HideNonStorageServiceMountedDrives
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\ForceAllDrivesRemovable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\InitPropertyBag\ShowAllOpticalDevices
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NeverShowDrivesMask
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideDrivesWithNoMedia
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Mobility\LastResumeOnPCTime
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Mobility\LastResumeOnPCInteractionTime
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\OpenIcon
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\InitPropertyBag\HelpTopic
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\LocalizedString
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\DefaultIcon\OpenIcon
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\LocalizedString
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\LocalizedString
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.Home.PropList.Sort
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\windows.storage.dll,-9216
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PropertyBag\BaseFolderId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PropertyBag\BaseFolderId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PropertyBag\BaseFolderId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\System.StorageProviderUIStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\System.StorageProviderState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\{E77E90DF-6271-4F5B-834F-2DD1F245DDA4} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\System.Volume.IsRoot
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\{9B174B35-40FF-11D2-A27E-00C04FC30871} 10
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.StatusIcons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\{7A55582B-BD8C-4475-B94C-B87A388A7899} 100
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\{1E3EE840-BC2B-476C-8237-2ACD1A839B22} 3
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.Rkcybere
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\System.Volume.BitLockerProtection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\{2D15A9A1-A556-4189-91AD-027458F11A07} 1717
  • HKEY_CURRENT_USER\AppEvents\Schemes\Apps\Explorer\Navigating\.Current\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\TextInput\ConfigureJapaneseIMEVersion\Value
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Size
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\FolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\KnownFolderDerivedFolderType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupCollapseState
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\PropertyBag\NoCustomize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\FolderValueFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsParseDisplayName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\QueryForInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\EnableThumbnails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\NoDefaultToFS
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\ParseDisplayNameNeedsURL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\BlockNewFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\NoInitRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\SafeRootForMTA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\WantsSendToTarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\NoLocalizedNameInTarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3364BA0-65B9-11CE-A9BA-00AA004AE837}\ShellFolder\DisableContextualTabset
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\InProcServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.properties\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 9
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\FirstEntry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\LastEntry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\2026
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\2007
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\2027
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\FriendlyTypeName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\SafeProcessSearchMode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\DataProtection\EDPShowIcons\Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.PropList.StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{26DC287C-6E3D-4BD3-B2B0-6A26BA2E346D} 4
  • HKEY_CURRENT_USER\Software\Classes\Directory\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.StatusIcons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{7A55582B-BD8C-4475-B94C-B87A388A7899} 100
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.PropList.StatusIcons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{C9944A21-A406-48FE-8225-AEC7E24C211B} 16
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.SharingStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{EF884C5B-2BFE-41BB-AAE5-76EEDF4F9902} 300
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.SharedWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{EF884C5B-2BFE-41BB-AAE5-76EEDF4F9902} 200
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.OfflineStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{6D24888F-4718-4BDA-AFED-EA0FB4386CD8} 100
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.LibraryLocationsCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{908696C7-8F87-44F2-80ED-A8C1C6894575} 2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\System.Sync.ItemState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\{7BD5533E-AF15-44DB-B8C8-BD6624E1D032} 25
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.ApplicationExtension\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateOnHostFlags
  • HKEY_CURRENT_USER\Software\Classes\Directory\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
  • HKEY_CURRENT_USER\Software\Classes\Directory\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Classes\Directory\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\Directory\AlwaysShowExt
  • HKEY_CURRENT_USER\Software\Classes\Directory\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\GlobalAssocChangedCounter
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\GlobalAssocChangedCounter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\microsoft-edge\URL Protocol
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXen1zmpxj5y8hccxeamgss1pv44xm9s4c
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXkm0p48j6vxa6sy1kzptp6c0skbrxk2xn
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX3302e372sk11smx9tbq60y86ggqfxvy1
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXm3ssa619v4xrhhddxj7maks7afa875sn
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX5vch6tap2vdqjatpmmze527d6gbw9snf
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXgtd8h4tnyrbh96yaxwt6z3pgwz63tg4e
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXxygf2kzevwed6xtc0tnvag57321m0gf7
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXqbwwf452mex80ks5a1qcgdbx4q1q68ps
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX9a5b64vqrc7t295d0avsvkqjbcdcasb7
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXbpvt3ybb9z170k77w6aygrkk3dpbx7mb
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXm09rke5hc4nvhb8wjwhv1zafzzstx1y2
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXh02wydnwxxfzrncb6xbx9y365rwsqrj0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX17g64qt4xqrmcgsbg0rt0r5pz91807cc
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXtkxgtha8255pnxrsbkg89t4f1wpmvger
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXpvggj8wtagvqq1trs4afp513ydqb63tt
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXkz68dp558dnjsc1ycr8f283vxqwzxstp
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXgvfc47vdahvb6zamkja2gyckzmx6q5xs
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX6718mn68jej1kxz691e99c70v5b37pv0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXpk3ftb6c358840b76bevz745rj5p9nkd
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX965kgq2vdagyyvkr19xz1tznhv8zk22p
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXh7gch3awtd2ekrcke8ktgxdew9dpq4gg
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXpb2rprh78ppcr2kwetykjxfzjgj219r0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXg6bgebytw9271kpwkyxm8t8s3zar0kg4
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders\StorageDelegate
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX16s5agjg9z17wcy7srnx53ggb3bg1kkk
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXgmcpn0gq19yzw2f9cqpg6saesfc0kybt
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXk1xfdrxj0frfne472rb7b2khxycqzx5x
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXwbzyd2zvdcrg5n0kqs9656aedk69jvdn
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX5xzkhwabag7tnvestq8sq2mr9aj8zar1
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX62tmns3r7mfjj7zmt4812e41tngg8jjg
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX8ar856dxr16fbc5qq5wfv0wr3pbkbt6b
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXnzea40qecbxvx5d82k30pzmnkk9x1yzc
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXmsxme3p13bxdhe981xm4mhe85549r803
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX4ztg00pywtgkv3d1109g9bfffry8qgc4
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXxevv7w4echwe3sagycz14jet3p1yv42y
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX4eeje680ymkh4aq4e16r99mv706ssk59
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX0ckx7rcw2py1jn1dhe11tgddg9cz4f8q
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXhs9ftp6gpj2rfhftf1t60n8ar0c0zgph
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX8tw43gpb5qj1wsq9bkhecdqbx9g4rdpc
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXnxybh9gej9ah7k6wcw3g39f2ssczetzq
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXxrp0f9h19m81p2jh0836h680jhs01vtm
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXcb3213yx90n9xkdt47ajfwnh99hwn4nq
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXak90wawbmx6n9rc79y67hg6myh1tm6ky
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\URLAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{04731B67-D933-450a-90E6-4ACD2E9408FE}\SortOrderIndex
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXcdgbg1vz5fyrfg44thjqv4g8fzdzs3cw
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\URLAssociations\microsoft-edge
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXsj6x275z6n8r00d0ya2a1q5ht4b2nvf9
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\File Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\UrlAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Address Book
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Disc Image Burner
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Search
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\UrlAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Internet Explorer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Notepad
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Wordpad
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\URLAssociations\microsoft-edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\Hidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\microsoft-edge\UserChoice\ProgId
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\microsoft-edge\UserChoice\Hash
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5b934b42-522b-4c34-bbfe-37a3ef7b9c90}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.lnk
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98F275B4-4FFF-11E0-89E2-7B86DFD72085}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\DocObject
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\AlwaysShowExt
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\(Default)
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\DescriptionID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IE.AssocFile.URL\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\RecursiveSearch
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\TargetKnownFolder
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\AlwaysShowExt
  • HKEY_CURRENT_USER\Software\Classes\IE.AssocFile.URL\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\InitPropertyBag\AllowChildAliasRegistration
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\EnableShareDenyNone
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\Instance\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\PropertyBag\ThisPCPolicy
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\ColorPrevalence
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\SystemUsesLightTheme
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\PropertyBag\ThisPCPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\PackageOrigin
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\PackageStatus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\PackageFullName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\PackageType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\Volume
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\OSMaxVersionTested
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\InstalledLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\MutableLink
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\MutableLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\TargetDeviceFamilyName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\b2\Flags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\pythonsoftwarefoundation.pythonmanager_3847v3x7pw1km\ResourcesConfig\CachedMergedResourcesPriFileName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\LocalizedString
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\OpenIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.lnk
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.lnk\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemNameDisplay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.SFGAOFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.DateModified
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.Kind
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.FileName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemPathDisplay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemFolderNameDisplay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemFolderPathDisplay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.IconPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 14
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.DateModified
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.exe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.exe\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66742402-F9B9-11D1-A202-0000F81FEDEE}\UseOutOfProcHandlerCache
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.ThumbnailCacheId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{446D16B1-8DAD-4870-A748-402EA43D788C} 100
  • HKEY_CURRENT_USER\Software\Classes\.png\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice\ProgId
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice\Hash
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a38b883c-1682-497e-97b0-0a3a9e801682}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.url\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ExplorerCLSIDFlags\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\UseOutOfProcHandlerCache
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice\ProgId
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.url\UserChoice\Hash
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{645FF040-5081-101B-9F08-00AA002F954E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{645FF040-5081-101B-9F08-00AA002F954E}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{031E4825-7B94-4DC3-B131-E946B44C8DD5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{031E4825-7B94-4DC3-B131-E946B44C8DD5}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\System.HideOnDesktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{59031A47-3F72-44A7-89C5-5595FE6B30EE}
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.HideOnDesktop
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 34
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel\{018D5C66-4533-4307-9B53-224DE2ED1FE6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2\Key
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2\VarType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\2\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{5CBF2787-48CF-4208-B90E-EE5E5D420294}\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\Key
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\8\VarType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\Key
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\15\VarType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2\Section
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2\Key
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06EEE834-461C-42c2-8DCF-1502B527B1F9}\Instance\PropertySetStorage\{000214A0-0000-0000-C000-000000000046}\2\VarType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\System.FileAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\{B725F130-47EF-101A-A5F1-02608C9EEBAC} 13
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\https\URL Protocol
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX9p17f69fv477faczm440keb1b6qmf2d7
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXezhx1g574qt7ved4c6n8xc7dv69hp5b9
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXt7wecsz30g50zd235hqdg6edj7bz373q
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXrzncjcz58hgp52t1bcacmj7qj4p7fgy4
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX29xjyxk6s619ed3bxzny0w9dtw9j3bj7
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXsb1zgj7e45ja97qva5xv68rnf2mweyv6
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX14sgk3n9en7k0bkktc9b16422015ebss
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppX4vpjzagr9bt8abh3j750s58kqkbxhb97
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXs43fd19nmbh94dynnq1r143fs10qjvhg
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXc9hsmcxm3scx9z9f7a1fvjq1e0pmeg3a
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\SOFTWARE\RegisteredApplications\AppXc6tpxne90zak0nztv1brdbfwsjmes2qq
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\URLAssociations\https
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\UrlAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\UrlAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Paint
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Media Player
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Windows Photo Viewer
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Microsoft Edge
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications\Google Chrome
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations\https
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\Hidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice\ProgId
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice\Hash
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ChromeHTML\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\ShellEx\{000214F9-0000-0000-C000-000000000046}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.newfolder\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.help\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.undo\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.redo\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\PreviewDetails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\PreviewDetails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\PreviewDetails
  • HKEY_CURRENT_USER\Software\Classes\*\PreviewDetails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.RibbonDelete\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F2153260-232E-4474-9D0A-9F2AB153441D}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecycleFiles
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{528c102f-0000-0000-0000-300300000000}\MaxCapacity
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{528c102f-0000-0000-0000-300300000000}\NukeOnDelete
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum
  • HKEY_CURRENT_USER\Software\Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC992F1F-DEBB-4596-B355-50C7A6DD1222}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\ContextMenuHandlers\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Library Location\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Library Location\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Offline Files\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Offline Files\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PintoStartScreen\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\PintoStartScreen\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\SuppressionPolicy
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\SuppressionPolicy
  • HKEY_CURRENT_USER\Software\Classes\*\shellex\ContextMenuHandlers\ FileSyncEx\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ModernSharing\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ModernSharing\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Open With EncryptionMenu\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Sharing\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Sharing\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WorkFolders\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WorkFolders\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\CopyAsPathMenu\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\CopyAsPathMenu\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SendTo\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\SendTo\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{596AB062-B4D2-4215-9F74-E9109B0A8153}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\SuppressionPolicy
  • HKEY_CURRENT_USER\Software\Classes\*\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09799AFB-AD67-11d1-ABCD-00C04FC30936}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21B22460-3AEA-1069-A2DC-08002B30309D}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\find\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\MultiSelectModel
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultipleInvokePromptMinimum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MultipleInvokePromptMinimum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SeparatorBefore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\SeparatorAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\DefaultAppliesTo
  • HKEY_CURRENT_USER\Software\Classes\*\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\ResolveLinksInvokeBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\InvokeCommandOnSelection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\OpenControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\OpenControlPanelPage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationDefaults.ApplicationDefaultHelpers\ActivateOnHostFlags
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts\CompressedFolder_.zip
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList\MRUList
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\location
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IsoBurn\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IsoBurn\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Notepad\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Notepad\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\Hidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\FileAssociations\.zip
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\Hidden
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.zip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\accwiz.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\ARTGALRY.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\awdvstub.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cag.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\CChat.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cdfview.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\CMMGR32.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cryptext.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\datainst.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\depends.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\dsquery.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\explorer.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\faxcover.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\finder.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\fontview.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\fpidcwiz.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\graflink.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\grpconv.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\helpctr.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\hh.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\HYPERTRM.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Command\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\inetcpl.cpl\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\ISIGNUP.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\isoburn.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\isoburn.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\kodakprv.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\licensemanagershellext.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\MMC.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mnyimprt.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mplayer.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\msconf.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mshta.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\msiexec.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\msimn.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\MSInfo32.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\command\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\msrating.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\netshell.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\NTVDM.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\NTVDM.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\oledb32.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\ORGCHART.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OSA.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Outlook.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\perfmon.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\photoviewer.dll\shell\print\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\provtool.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\rasphone.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\regedit.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\runtimebroker.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\runtimebroker.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\sdclt.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\shdocvw.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\shell32.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\snapview.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SystemReset.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\SystemReset.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\taskmgr.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\taskmgr.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\themes.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Ttxmpc97.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\url.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wab.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WB32.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\winhlp32.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WINWORD.EXE\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WINWORD.EXE\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wltmime.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmpdmc.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmpdmc.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\command\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\command\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wpnpinst.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\WScript.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wusa.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\zipfldr.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\AppUserModelID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\PolicyType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\grouppolicypath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\grouppolicyismultisz
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\grouppolicymultiszSeparatorChar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\AppHVSI\AllowAppHVSI\Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\NoSmartScreen
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Security.SmartScreen.AppReputationService\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\SmartScreen\EnableSmartScreenInShell\Behavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\EnableSmartScreen
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SmartScreenEnabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.der\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.grp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hlp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hta\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.img\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.iso\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.JSE\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msc\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msi\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msu\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pif\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pl\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.plg\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.prf\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.printerExport\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ps1\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ps1xml\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.psc1\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.psd1\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.psm1\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.reg\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scf\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scr\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sct\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.theme\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.VBE\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vhd\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vhdx\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.webpnp\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wsc\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WSF\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WSH\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\EditFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\ExecutableTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\LocalServerOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11dbb47c-a525-400b-9e80-a54615a090c0}\InProcServer32\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\StoreInit\AppExtensionPackageEventVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{831D1DFF-7F57-4720-87E4-CB57D6214428}\ProxyStubClsid32\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${b71d7125-ae43-46d2-b0d5-7d69e6addd38}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap\Current\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\LaunchExplorerFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{000214E2-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$$windows.data.platform.partitioning.systempartitionindex\Current\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\Parent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\CanonicalName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\Theme
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\LayoutType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\TopViewPersistence
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\ViewSettingsPersistence
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\Mode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\HelpTopic
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\Class
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\MostRelevant
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderTypes\{80213e82-bcfd-4c4f-8817-bb27601267a9}\DefaultView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\MaxRecentDocs
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.Launch.LauncherQueryInfo\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{15f99879-aa48-571f-845d-144893440cfd}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\AllowSilentDefaultTakeOver
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\PackageId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.zip\MajorDoc
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\MRUListEx
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\MRUList
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\5
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\7
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\6
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\0
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\3
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\explorer.exe\NoStaticDefaultVerb
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\Explorer.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\Explorer.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\WantsParseDisplayName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\NoDefaultToFS
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\ParseDisplayNameNeedsURL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\SafeRootForMTA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c39a5cf-1a7a-40c8-ba74-8900e6df5fcd}\ShellFolder\NoLocalizedNameInTarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{0C39A5CF-1A7A-40C8-BA74-8900E6DF5FCD}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Unspecified
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\OpenFileIn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\SaveFileIn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\CopyFrom
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\PasteTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\MoveTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\CopyPaste
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Share
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Move
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Create
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\Open
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\OpenIn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ApplicationDestinations\MFU\CreateIn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Url History\DaysToKeep
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\ShellFolder\DisableContextualTabset
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\tabsets\UseIdentityItem
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31}\tabsets\location
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF393560-C2A7-11CF-BFF4-444553540000}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\CurrentVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\StatusBar
  • HKEY_CURRENT_USER\Software\Classes\*\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Eastern Standard Time\Dynamic DST\2012
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{679f85cb-0220-4080-b29b-5540cc05aab6}\System.IsPinnedToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\FormatForDisplayHelper
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\EditFlags
  • HKEY_CURRENT_USER\Software\Classes\*\EditFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\EditFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\EditFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\NeverDefault
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1807
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1807
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum\Implementing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemovalTools\MRT\GUID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EnableRemoteManagedDefaults
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableLocalAdminMerge
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\BetaPlatform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\BetaPlatform
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\InstallLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\ManagedDefenderProductType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\ManagedDefenderProductType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\PassiveMode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\PassiveMode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\SenseEnabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpEngineRing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\MpEngine\MpCampRing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\ProductAppDataPath
  • HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager\AllowRealtimeMonitoring
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\ReadWriteTempFile
  • HKEY_CURRENT_USER\Software\Classes\*\ReadWriteTempFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\ReadWriteTempFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ReadWriteTempFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.exe_
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList\MRUList
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IsoBurn\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Notepad\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Photo Viewer\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\drwatson.exe\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\shscrap.dll\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\SeparatorBefore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\InvokeDefaultVerbInOtherProcess\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\Open\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\OpenWithSetDefaultOn\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\NoRecentDocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\ResolveLinksInvokeBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\InvokeCommandOnSelection
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\OpenControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\OpenControlPanelPage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\AppUserModelID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\NoSmartScreen
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\LocalServerOnly
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E44E9428-BDBC-4987-A099-40DC8FD255E7} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FC4801A3-2BA9-11CF-A229-00AA003D7352}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C9CD5BB-98E9-4491-A60F-31AACC72B83C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{85075ACF-231F-40EA-9610-D26B7B58F638}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18B21AA9-E184-4FF0-9F5E-F882D03771B3}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9D923EDC-B7A9-4F77-9933-284E7E2B2536}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1AF3A467-214F-4298-908E-06B03E0B39F9}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{667708D1-A931-4A85-9999-609EAA7DD85A}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\shell\openas\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\NoStaticDefaultVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\OpenWith.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\OpenWith.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c2f03a33-21f5-47fa-b4bb-156362a2f239}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4D4C1E64-E410-4FAA-BAFA-59CA069BFEC2}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\NoStartPage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\OpenWith.exe\IsHostApp
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{880B26F8-9197-43D0-8045-8702D0D72000}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D770B2AD-8F5E-4B8E-B3DF-F05A2AB5287C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{228826af-02e1-4226-a9e0-99a855e455a6}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37987DB6-9D85-4381-8D7D-3189661223D1}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{37987DB6-9D85-4381-8D7D-3189661223D1}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8D4D1EC2-4740-4FC5-B4B1-6DC3722A2EEB}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{67136E8B-6914-43F0-8F25-05619927D22E}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\MRUList
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete\AutoSuggest
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AccListViewV6
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\UseDoubleClickTimer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\SortOrderIndex
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\MRUList
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\NodeSlot
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\SystemIndexNormalization
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\StatusBar
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\PreviewDetails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.rename\AppliesTo
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowPreviewHandlers
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\ShellEx\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ed9d80b9-d157-457b-9192-0e7280313bf0}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{ED9D80B9-D157-457B-9192-0E7280313BF0} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaximumAllowedAllocationSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NoPreviousVersions
  • HKEY_CURRENT_USER\Software\Classes\*\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoPreviousVersions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{596AB062-B4D2-4215-9F74-E9109B0A8153}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NoPreviousVersionsPage
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NoPreviousVersionsPage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NoSendTo
  • HKEY_CURRENT_USER\Software\Classes\*\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoSendTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7BA4C740-9E81-11CF-99D3-00AA004AE837}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSendToMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\DelaySendToMenuBuild
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrivesInSendToMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f3d06e7c-1e45-4a26-847e-f9fcdee59be0}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{90AA3A4E-1CBA-4233-B8BB-535773D48449}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E61BF828-5E63-4287-BEF1-60B1A4FDE0E3} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@zipfldr.dll,-10148
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\System32\fsquirt.exe,-2343
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81E9010-6EA4-11CE-A7FF-00AA003CA9F6} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@sendmail.dll,-4
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-120
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@sendmail.dll,-21
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler\(Default)
  • HKEY_CURRENT_USER\Software\Classes\lnkfile\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.lnk\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99D353BC-C813-41ec-8F28-EAE61E702E57}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99D353BC-C813-41ec-8F28-EAE61E702E57}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{99D353BC-C813-41EC-8F28-EAE61E702E57} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.LNK
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemPathDisplayNarrow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-0000-0000-C000-000000000046}\OverrideFileSystemProperties\System.ItemFolderPathDisplayNarrow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.Share\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler\(Default)
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SharingWizardOn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SharingWizardOn
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInplaceSharing
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6311429E-2F1A-4777-880F-C7289FD10169}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoEncryption
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A470F8CF-A1E8-4f65-8335-227475AA5C46}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityStore\Providers\{D7F9888F-E3FC-49b0-9EA6-A85B5F392A4F}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2bf9676-5f8f-435c-97eb-11607a5bedf7}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2bf9676-5f8f-435c-97eb-11607a5bedf7}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e2bf9676-5f8f-435c-97eb-11607a5bedf7}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\ExplorerCommandHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2BF9676-5F8F-435C-97EB-11607A5BEDF7} {A08CE4D0-FA25-44AB-B57C-C7B1C323E0B9} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.DataTransfer.DataTransferManager\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\CommandStateSync
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CommandStore\shell\Windows.ModernShare\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09A47860-11B0-4DA5-AFA5-26D86198A780}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09A47860-11B0-4DA5-AFA5-26D86198A780}\InprocServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{09A47860-11B0-4DA5-AFA5-26D86198A780} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{470C0EBD-5D73-4d58-9CED-E91E22E23282}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{470C0EBD-5D73-4d58-9CED-E91E22E23282}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86C86720-42A0-1069-A2E8-08002B30309D}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86C86720-42A0-1069-A2E8-08002B30309D}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86C86720-42A0-1069-A2E8-08002B30309D}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86C86720-42A0-1069-A2E8-08002B30309D}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{470C0EBD-5D73-4d58-9CED-E91E22E23282}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoChangeStartMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\PolicyType
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\System32\fsquirt.exe.FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\Behavior
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\System32\fsquirt.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\MergeAlgorithm
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\RegKeyPathRedirectMapped
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\RegKeyPathRedirect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\grouppolicyname
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\ADMXMetadataUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\ADMXMetadataDevice
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\ADMXMetadataBoth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\30Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Start\StartLayout\Value
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\WindowsInternal.Shell.UnifiedTile.UnifiedTileIdentifierExtractor\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}\InProcServer32\LoadWithoutCOM
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{474C98EE-CF3D-41f5-80E3-4AAB0AB04301}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\UserState\UserStateTechnologies\ConfigurationControls\OfflineFiles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B8CDCB65-B1BF-4B42-9428-1DFDB7EE92AF} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af}\flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.zfsendtotarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ZFSendToTarget\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ZFSendToTarget\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\Shell\Open\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\ShellEx\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\explore\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SeparatorBefore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\open\SeparatorAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewprocess\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewtab\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\MUIVerb
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@windows.storage.dll,-8517
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\ReadWriteRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\DownloadInvokeDisabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\MaxDownloadFileSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SeparatorBefore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\opennewwindow\SeparatorAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\command\DelegateExecute
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\MultiSelectModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\MUIVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\FolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\StaticVerbOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\IsInContextMenu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\SendToVerb
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\PaneVisibleProperty
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\AppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shell\pintohome\ShowAsDisabledIfHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\NoStaticDefaultVerb
  • HKEY_CURRENT_USER\Software\Classes\*\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\removeproperties\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ActivationModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\MultiSelectModel
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LegacyPlayerInvokeLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LegacyPlayerInvokeLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\MUIVerb
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@efscore.dll,-101
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ImpliedSelectionModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ResolveLinksQueryBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ShowBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\HideBasedOnVelocityID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\AttributeMask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\AttributeValue
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shell\UpdateEncryptionSettingsWork\ShowAsDisabledIfHidden
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\SeparatorBeforeAndAfter
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\ExplorerCommandHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\LegacyDisable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\CheckSupportedTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\SuppressionPolicyEx
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\LaunchWorkfoldersControl\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\CommandStateHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\DefaultAppliesTo
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\CommandFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\SubCommands
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\ExtendedSubCommandsKey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\HasLUAShield
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\Extended
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\OnlyInBrowserWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\OnlyInTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\OfflineFilesLaunchSyncCenter\ProgrammaticAccessOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{888DCA60-FC0A-11CF-8F0F-00C04FD7D062}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.desklink
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.desklink\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.desklink\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.desklink\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.DeskLink
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\shellex\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE61-C50F-11CF-9A2C-00A0C90A90CE}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.mydocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mydocs\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mydocs\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mydocs\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.mydocs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\shellex\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{ECF03A32-103D-11D2-854D-006008059367} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersLibraries\NameSpace\ValidateRegItems
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UsersLibraries\NameSpace\MonitorRegistry
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.library-ms
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.library-ms\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.library-ms\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\ShellEx\IconHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.library-ms\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\CLSID\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\FolderValueFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsFORDISPLAY
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\HideFolderVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\UseDropHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsFORPARSING
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsParseDisplayName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\QueryForOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\MapNetDriveVerbs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\QueryForInfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\HideOnDesktopPerUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsAliasedNotifications
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsUniversalDelegate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\NoFileFolderJunction
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\PinToNameSpaceTree
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\HasNavigationEnum
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\EnableThumbnails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\NoDefaultToFS
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\ParseDisplayNameNeedsURL
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\BlockNewFile
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\NoInitRequired
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\SafeRootForMTA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\WantsSendToTarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a5a3563a-5755-4a6f-854e-afa3230b199f}\ShellFolder\NoLocalizedNameInTarget
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{A5A3563A-5755-4A6F-854E-AFA3230B199F}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@windows.storage.dll,-34575
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LibraryFolder\ShellEx\LibraryDescriptionHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fe5afcf2-e681-4ada-9703-ef39b8ecb9bf}\EnableShareDenyNone
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000103-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CompressedFolder\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.zip\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DefaultDropEffect
  • HKEY_CURRENT_USER\Software\Classes\*\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DefaultDropEffect
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\{BD472F60-27FA-11cf-B8B4-444553540000}\SuppressionPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ECF03A32-103D-11d2-854D-006008059367}\DefaultIcon\(Default)
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\WFS.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\WFS.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.mapimail
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mapimail\Content Type
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mapimail\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mapimail\PerceivedType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.MAPIMail
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\shellex\DropHandler\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9E56BE60-C50F-11CF-9A2C-00A0C90A90CE}\DefaultIcon\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\HwOrder\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder\RDPNP
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder\LanmanWorkstation
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\NetworkProvider\ProviderOrder\webclient
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPNP\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPNP\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\RDPNP\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider\name
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider\Class
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WebClient\NetworkProvider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\NetworkProvider\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\UBR
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\DisplayVersion
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\ProviderOrder
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\Windows NT Access Provider\ProviderPath
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\RequireUniqueAccessibility
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\usagestats
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\AllowDevelopmentWithoutDevLicense
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseActivationAuthenticationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\brand
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\brand
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\brand
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32\DiagLevel
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32\DiagMatchAnyMask
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8018F647-BF07-55BB-82BE-A2D7049F7CE4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8A1D4361-2C08-4700-A351-3EAA9CBFF5E4}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ABC01078-F197-4B0B-ADBC-CFE684B39C82}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{521FDB42-7130-4806-822A-FC5163FAD983}\(Default)
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\AuthenticationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\AccessPermission
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91D01F44-11D0-4F2B-B516-757A456F47B1}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Containers\WaitForRestore
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF8E9480-CA73-448E-B8F0-DA000F581428}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAEE35A-508D-4419-9E56-50D658C2C812}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalService
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\DllSurrogate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\RunAs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ActivateAtStorage
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ROTFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AppIDFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\MGOTFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ProcessMitigationPolicy
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LaunchPermission
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AuthenticationLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\RemoteServerName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\SRPTrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\PreferredServerBitness
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LoadUserSettings
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ProtectionLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AccessPermission
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\GipActivityBypass
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75121952-e0d0-43e5-9380-1d80483acf72}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e44e9428-bdbc-4987-a099-40dc8fd255e7}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7F9185B0-CB92-43C5-80A9-92277A4F7B54}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{55272A00-42CB-11CE-8135-00AA004BB851}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6D5140C1-7436-11CE-8034-00AA006009FA}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A6FF50C0-56C0-71CA-5732-BED303A59628}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000114-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\ShellFolder\FolderValueFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{59031A47-3F72-44A7-89C5-5595FE6B30EE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellState
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3968686040-3210279463-847977608-1001\ProfileImagePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Data
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Data
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Generation
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Data
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ExePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\CommandLine
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\IdentityType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ActivatableClasses
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ServerType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\AppId
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\Identity
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ServiceName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ExplicitPsmActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NoOpenWith
  • HKEY_CURRENT_USER\Software\Classes\*\NoOpenWith
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NoOpenWith
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FontCache\Parameters\ClientCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\TransientObjects\%5C%5C.%5CRpc%5CAllowLpacAppExperience%5CInterface\SecurityDescriptor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Dwm\DisallowNonDrawListRendering
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.ViewManagement.UISettings\ActivateOnHostFlags
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Accessibility\TextScaleFactor
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList\a
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Wordpad\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\FileAssociations\.exe_
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\FileAssociations\.exe_
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\LangID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Internet Explorer\iexplore.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Internet Explorer\iexplore.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Max Cached Icons
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\shell\edit\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\mspaint.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\mspaint.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\mspaint.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{905e63b6-c1bf-494e-b29c-65b732d3d21a}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\shell\open\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\notepad.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\NOTEPAD.EXE.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\NOTEPAD.EXE.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.EXE
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\shell\play\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@wmploc.dll,-102
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files (x86)\Windows Media Player\wmplayer.exe.ApplicationCompany
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\shell\open\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\FriendlyAppName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\wordpad.exe\ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\ms-windows-store\URL Protocol
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.AAD.BrokerPlugin_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.OOBENetworkCaptivePortal_10.0.19041.3636_neutral__cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.manageaccounts\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.calendar\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\microsoft.windowslive.mail\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecHealthUI_10.0.19041.3636_neutral__cw5n1h2txyewy\SecHealthUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Pythonw.Exe\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\Python.Exe\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.XGpuEjectDialog_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.XGpuEjectDialog\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Windows.PrintDialog_6.2.1.0_neutral_neutral_cw5n1h2txyewy\Microsoft.Windows.PrintDialog\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.SecureAssessmentBrowser_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ParentalControls_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameCallableUI_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\Microsoft.XboxGameCallableUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ECApp_10.0.19041.3636_neutral__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneVideo\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Microsoft.ZuneMusic\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.XboxApp\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.TCUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\microsoft.onenoteim\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Microsoft.MSPaint\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftOfficeHub\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Microsoft.Microsoft3DViewer\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Apprep.ChxApp_1000.19041.3636.0_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\WindowsBackup\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\ScreenClipping\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\MicrosoftWindows.Client.CBS_1000.19053.1000.0_x64__cw5n1h2txyewy\InputApp\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\ShellFeedsUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\CortanaUI\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.ShellExperienceHost_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\App\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Capabilities\UrlAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Contacts\Address Book\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Capabilities\UrlAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\UrlAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Media\Windows Media Player\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\Capabilities\URLAssociations\ms-windows-store
  • HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Google Chrome\Capabilities\URLAssociations\ms-windows-store
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\PackageStatus
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\URL Protocol
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\AppUserModelID
  • HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Application\AppUserModelID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1e87508d-89c2-42f0-8a7e-645a0f50ca58}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\SortOrderIndex
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\ShellFolder\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\ShellFolder\CallForAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\ShellFolder\RestrictedAttributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4234d49b-0245-4df3-b780-3893943456e1}\ShellFolder\FolderValueFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{4234D49B-0245-4DF3-B780-3893943456E1}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\PreXPSP2ShellProtocolBehavior
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\LogFlags
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{4234D49B-0245-4DF3-B780-3893943456E1} {000214E6-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\Control Panel\International\User Profile\Languages
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5232f8ea-49c7-4840-bfbb-66e785689e88}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileQueryFilter\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivationType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\Server
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\DllPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\Threading
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\TrustLevel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\RemoteServer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivateAsUser
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivateInSharedBroker
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivateInBrokerForMediumILContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\Permissions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileViewQueryFilter\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e3dd5d31-892e-4ad6-9ce9-8fe1f185047b}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6a905a4b-cd66-5c7c-ab57-f5eb16c97257}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2be22368-4c98-5e9f-ac2b-de493c0c3e43}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{f502008f-7a0e-5757-8e65-ebad2e5a0e21}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19ad9e30-89f3-48f6-9c50-e34a59494544}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8a43ed9f-f4e6-4421-acf9-1dab2986820c}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{195f5943-0c04-4eab-b907-735817fdac77}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\InstalledLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\MutableLink
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1b0d3570-0877-5ec2-8a2c-3b9539506aca}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\PackageOrigin
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\PackageFullName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\PackageFamily
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\PackageType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\Flags2
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\Volume
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\OSMaxVersionTested
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\MutableLocation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\90\TargetDeviceFamilyName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\OEM\DeviceForm
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\ResourcesConfig\CachedMergedResourcesPriFileName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\ResourcesConfig\Language
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Microsoft.WindowsStore_8wekyb3d8bbwe\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Flags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Families\Microsoft.WindowsStore_8wekyb3d8bbwe\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Flags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\ResourcesConfig\ManifestLanguagesList
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windowsstore_8wekyb3d8bbwe\ResourcesConfig\OverrideLanguagesList
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisableThumbnails
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoThumbnailCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Hvsi\UIAutomationIsInRemoteOnlySession
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AlwaysAllowCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\EnableAnchorContext
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B849ACB5-8AC5-4FB8-88B6-55C749D25A44}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepositoryRoot
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\LanmanWorkstation\Parameters\RpcCacheTimeout
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FrameTabWindow
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FrameMerging
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SessionMerging
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\AdminTabProcs
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Security\RunBinaryControlHostProcessInSeparateAppContainer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\RunBinaryControlHostProcessInSeparateAppContainer
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\TabProcGrowth
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
  • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance\{41945702-8302-44A6-9445-AC98E8AFA086}\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Author
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\FriendlyName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SpecVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Vendor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\ContainerFormat
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\DeviceManufacturer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\DeviceModels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\ColorManagementVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\MimeTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\FileExtensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SupportAnimation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SupportChromakey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SupportLossless
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\SupportMultiframe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\ArbitrationPriority
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\0\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\1\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\10\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\11\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\12\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\13\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\14\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\2\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\3\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\4\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\5\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\6\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\7\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\8\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{41945702-8302-44A6-9445-AC98E8AFA086}\Patterns\9\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7ED96837-96F0-4812-B211-F13C24117ED3}\Instance\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\CLSID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Author
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\FriendlyName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SpecVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Vendor
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\ContainerFormat
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\DeviceManufacturer
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\DeviceModels
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\ColorManagementVersion
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\MimeTypes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\FileExtensions
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SupportAnimation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SupportChromakey
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SupportLossless
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\SupportMultiframe
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\ArbitrationPriority
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9\Pattern
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\0\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\1\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\10\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\11\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\12\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\2\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\3\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\4\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\5\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\6\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\7\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\8\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9\Position
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9\EndOfStream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5FDD51E2-A9D0-44CE-8C8D-162BA0C591A0}\Patterns\9\Mask
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{f42ee2d3-909f-4907-8871-4c22fc0bf756}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{F42EE2D3-909F-4907-8871-4C22FC0BF756}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{a0c69a99-21c8-4671-8703-7934162fcf1d}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{A0C69A99-21C8-4671-8703-7934162FCF1D}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0ddd015d-b06c-45d5-8c4c-f59713854639}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{0DDD015D-B06C-45D5-8C4C-F59713854639}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{35286a68-3c57-41a1-bbb1-0eae73d76c95}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{35286A68-3C57-41A1-BBB1-0EAE73D76C95}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{7d83ee9b-2244-4e70-b1f5-5393042af1e4}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{7D83EE9B-2244-4E70-B1F5-5393042AF1E4}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A52BBA46-E9E1-435f-B3D9-28DAA648C0F6}\InitFolderHandler
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{A52BBA46-E9E1-435F-B3D9-28DAA648C0F6}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Category
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Name
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\ParentFolder
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Description
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\RelativePath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\ParsingName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\InfoTip
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\LocalizedName
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Icon
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Security
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\StreamResource
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\StreamResourceType
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\LocalRedirectOnly
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Roamable
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PreCreate
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Stream
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PublishExpandedPath
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\DefinitionFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Attributes
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\FolderTypeID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\InitFolderHandler
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.png
  • HKEY_CURRENT_USER\Software\Classes\.png\Content Type
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\DocObject
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\DocObject
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\BrowseInPlace
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\BrowseInPlace
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\IsShortcut
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\IsShortcut
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\AlwaysShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\AlwaysShowExt
  • HKEY_CURRENT_USER\Software\Classes\AppX43hnxtbyyps62jhe9sqpdzxn1790zetc\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.png\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\NeverShowExt
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4cc8fe6a-5976-4ece-ac32-62e2a5497f46}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e78f846c-10bc-4153-9bb5-5b30018e31f2}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\{e357fccd-a995-4576-b01f-234630154e96}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\DisableProcessIsolation
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\NoOplock
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\UseInProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\UseOutOfProcHandlerCache
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\InProcServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\InProcServer32\LoadWithoutCOM
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C7657C4A-9F68-40FA-A4DF-96BC08EB3551} {E357FCCD-A995-4576-B01F-234630154E96} 0xFFFF
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C7657C4A-9F68-40fa-A4DF-96BC08EB3551}\EnableShareDenyNone
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\channel
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\ap
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\name
  • HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
  • HKEY_USERS\.DEFAULT\Control Panel\International\sList
  • HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
  • HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
  • HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
  • HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
  • HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
  • HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
  • HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
  • HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
  • HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
  • HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
  • HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
  • HKEY_USERS\.DEFAULT\Control Panel\International\s1159
  • HKEY_USERS\.DEFAULT\Control Panel\International\s2359
  • HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
  • HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
  • HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
  • HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
  • HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
  • HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
  • HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
  • HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
  • HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
  • HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
  • HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
  • HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
  • HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
  • HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
  • HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
  • HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
  • HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
  • HKEY_USERS\.DEFAULT\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Currencies
  • HKEY_USERS\.DEFAULT\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Calendar
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-AU
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-AU
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-AU
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{708860E0-F641-4611-8895-7D867DD3675B}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{1BF5208B-295F-4992-B5F4-3A9BB6494838}\1.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\UDTAlignmentPolicy
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\LsaPid
  • HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cryptography\Providers\Microsoft Software Key Storage Provider\UM\00010001\Flags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\InprocServer32
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020424-0000-0000-C000-000000000046}\AppID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{665C572C-9FF8-5129-812D-1EF725430831}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{665C572C-9FF8-5129-812D-1EF725430831}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{A2C06829-9487-5D5F-8DFA-AB273A36649C}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}\ActivateOnHostFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5E692018-D934-5C71-B901-CADC92ED774C}\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{ACAB122B-29C0-56A9-8145-AFA2F82A547C}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D39AC5FB-3662-521F-B4DA-149AA6CB515E}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\ProxyStubClsid32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\TypeLib\Version
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{0486745C-8D9B-5377-A54C-A61FFAA0BBE4}\1.0\0\win32\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\OemInstallTime
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\pv
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\DayOfLastActivity
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\DayOfLastRollCall
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\DayOfInstall
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{8a69d345-d564-463c-aff1-a69d9e530f96}\cohort\hint
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\pv
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\ap
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\DayOfLastActivity
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\DayOfLastRollCall
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\DayOfInstall
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\(Default)
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\name
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientState\{2c7ed102-d237-41b3-9a78-7ec8ca5a4692}\cohort\hint
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\pv
  • EnrollmentToken
  • CloudManagementEnrollmentToken
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{44fc7fe2-65ce-487c-93f4-edee46eeaaab}\CloudManagementEnrollmentToken
  • HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\Clients\{430fd4d0-b729-4f61-aa34-91526481799d}\CloudManagementEnrollmentToken
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon\MinimizedStateTabletModeOff
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Ribbon\QatItems
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000090046
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\HRZR_PGYFRFFVBA
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Zvpebfbsg.Jvaqbjf.Rkcybere
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Rev
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\FFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Vid
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Mode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\LogicalViewMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\IconSize
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\Sort
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\ColInfo
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupView
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:FMTID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByKey:PID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupByDirection
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\GlobalSettings\ProperTreeModuleInner\ProperTreeModuleInner
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane\ExpandedState
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\IconLayouts
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\IconNameVersion
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithProgids\CompressedFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${b71d7125-ae43-46d2-b0d5-7d69e6addd38}$$windows.data.unifiedtile.localstartvolatiletilepropertiesmap\Current\Data
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E88DCCE0-B7B3-11D1-A9F0-00AA0060FA31} {000214E6-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\8
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\0
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\MRUListEx
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\MRUListEx
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E44E9428-BDBC-4987-A099-40DC8FD255E7} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0xFFFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum\Implementing
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\OpenWith.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\OpenWith.exe.ApplicationCompany
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList\a
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe_\OpenWithList\MRUList
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo\02091777-C187-951A-0E4E-E98CEC442EC9
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Rev
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\FFlags
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Vid
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Mode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\LogicalViewMode
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\IconSize
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\Sort
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\ColInfo
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupView
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:FMTID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByKey:PID
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupByDirection
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{ED9D80B9-D157-457B-9192-0E7280313BF0} {00000122-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@sendmail.dll,-21
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@zipfldr.dll,-10148
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\System32\fsquirt.exe,-2343
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@sendmail.dll,-4
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-120
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B8CDCB65-B1BF-4B42-9428-1DFDB7EE92AF} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@windows.storage.dll,-8517
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@efscore.dll,-101
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@windows.storage.dll,-34575
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@windows.storage.dll,-21825
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000404C0
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@C:\Windows\system32\windows.storage.dll,-50691
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{BD472F60-27FA-11CF-B8B4-444553540000} {000214E4-0000-0000-C000-000000000046} 0xFFFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ExtractionWizard
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ExtractionWizard\ShowFiles
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\1
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\1\NodeSlot
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\1\MRUListEx
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\Shell\SniffedFolderType
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Cortana\IsAvailable
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2\OpenWithProgids\WMP11.AssocFile.3G2
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithProgids\WMP11.AssocFile.3GP
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp2\OpenWithProgids\WMP11.AssocFile.3G2
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithProgids\WMP11.AssocFile.3GP
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aac\OpenWithProgids\WMP11.AssocFile.ADTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adt\OpenWithProgids\WMP11.AssocFile.ADTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.adts\OpenWithProgids\WMP11.AssocFile.ADTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithProgids\WMP11.AssocFile.AIFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithProgids\WMP11.AssocFile.AIFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithProgids\WMP11.AssocFile.AIFF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithProgids\WMP11.AssocFile.ASF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithProgids\WMP11.AssocFile.ASX
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithProgids\WMP11.AssocFile.AU
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithProgids\WMP11.AssocFile.AVI
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids\Paint.Picture
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cab\OpenWithProgids\CABFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cdxml\OpenWithProgids\Microsoft.PowerShellCmdletDefinitionXML.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.css\OpenWithProgids\CSSfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dds\OpenWithProgids\ddsfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithProgids\Paint.Picture
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dll\OpenWithProgids\dllfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.docx\OpenWithProgids\docxfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\OpenWithProgids\emffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.flac\OpenWithProgids\WMP11.AssocFile.FLAC
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fon\OpenWithProgids\fonfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithProgids\giffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithProgids\htmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithProgids\htmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithProgids\icofile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inf\OpenWithProgids\inffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ini\OpenWithProgids\inifile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithProgids\pjpegfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithProgids\jpegfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithProgids\jpegfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithProgids\jpegfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jxr\OpenWithProgids\wdpfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\OpenWithProgids\lnkfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2t\OpenWithProgids\WMP11.AssocFile.M2TS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2ts\OpenWithProgids\WMP11.AssocFile.M2TS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithProgids\WMP11.AssocFile.m3u
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithProgids\WMP11.AssocFile.M4A
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithProgids\WMP11.AssocFile.MP4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithProgids\mhtmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithProgids\mhtmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithProgids\WMP11.AssocFile.MIDI
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.midi\OpenWithProgids\WMP11.AssocFile.MIDI
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mk3d\OpenWithProgids\WMP11.AssocFile.MK3D
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mka\OpenWithProgids\WMP11.AssocFile.MKA
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mkv\OpenWithProgids\WMP11.AssocFile.MKV
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mod\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithProgids\WMP11.AssocFile.MOV
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MP2\OpenWithProgids\WMP11.AssocFile.MP3
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithProgids\WMP11.AssocFile.MP3
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4\OpenWithProgids\WMP11.AssocFile.MP4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v\OpenWithProgids\WMP11.AssocFile.MP4
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MPE\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithProgids\WMP11.AssocFile.MPEG
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mts\OpenWithProgids\WMP11.AssocFile.M2TS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ocx\OpenWithProgids\ocxfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odt\OpenWithProgids\odtfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.otf\OpenWithProgids\otffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithProgids\pngfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1\OpenWithProgids\Microsoft.PowerShellScript.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ps1xml\OpenWithProgids\Microsoft.PowerShellXMLData.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd1\OpenWithProgids\Microsoft.PowerShellData.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psm1\OpenWithProgids\Microsoft.PowerShellModule.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pssc\OpenWithProgids\Microsoft.PowerShellSessionConfiguration.1
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\OpenWithProgids\rlefile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithProgids\WMP11.AssocFile.MIDI
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rtf\OpenWithProgids\rtffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.scf\OpenWithProgids\SHCmdFile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.search-ms\OpenWithProgids\SearchFolder
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithProgids\WMP11.AssocFile.AU
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sys\OpenWithProgids\sysfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithProgids\TIFImage.Document
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithProgids\TIFImage.Document
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithProgids\WMP11.AssocFile.TTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\OpenWithProgids\ttcfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\OpenWithProgids\ttffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithProgids\WMP11.AssocFile.TTS
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids\txtfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithProgids\WMP11.AssocFile.WAV
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wax\OpenWithProgids\WMP11.AssocFile.WAX
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithProgids\wdpfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wm\OpenWithProgids\WMP11.AssocFile.ASF
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithProgids\WMP11.AssocFile.WMA
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\OpenWithProgids\wmffile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithProgids\WMP11.AssocFile.WMV
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmx\OpenWithProgids\WMP11.AssocFile.ASX
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WPL\OpenWithProgids\WMP11.AssocFile.WPL
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wvx\OpenWithProgids\WMP11.AssocFile.WVX
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithProgids\xmlfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xsl\OpenWithProgids\xslfile
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\TraySearchBoxVisible
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\TraySearchBoxVisibleOnAnyMonitor
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched\PythonSoftwareFoundation.PythonManager_3847v3x7pw1km!Python.Exe
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch\Chrome
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000305D2
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\Puebzr
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated\Chrome
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\TrayButtonClicked\StartButton
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\mspaint.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\mspaint.exe.ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\NOTEPAD.EXE.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Windows\system32\NOTEPAD.EXE.ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@wmploc.dll,-102
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files (x86)\Windows Media Player\wmplayer.exe.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files (x86)\Windows Media Player\wmplayer.exe.ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.FriendlyAppName
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\C:\Program Files\Windows NT\Accessories\WORDPAD.EXE.ApplicationCompany
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{24CCB8A6-C45A-477D-B940-3382B9225668}\GroupCollapseState
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupCollapseState
  • HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.zip\MRUList
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\0\MRUList
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\Shell\{80213E82-BCFD-4C4F-8817-BB27601267A9}\GroupCollapseState
  • HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\1\1\MRUList
  • ntdll.dll.RtlWow64GetCurrentMachine
  • ntdll.dll.RtlWow64IsWowGuestMachineSupported
  • "C:\Program Files\Google\Chrome\Application\chrome.exe"
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=148.0.7778.217 --initial-client-data=0x268,0x26c,0x270,0x230,0x274,0x7fff17d7e9c0,0x7fff17d7e9cc,0x7fff17d7e9d8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1872,i,14540359570268955314,14636693853279630793,262144 --field-trial-handle=2052,i,12847949457923763407,11722859483185275525,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2044,i,5151719473677860865,1677759856349050304,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1988 /prefetch:2
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=2232,i,8129623131730223059,4368493350858083646,524288 --field-trial-handle=2052,i,12847949457923763407,11722859483185275525,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2044,i,5151719473677860865,1677759856349050304,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2356 /prefetch:3
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --metrics-shmem-handle=2460,i,10420184094708610373,10478248265517829439,524288 --field-trial-handle=2052,i,12847949457923763407,11722859483185275525,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2044,i,5151719473677860865,1677759856349050304,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2508 /prefetch:8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780016941285038 --launch-time-ticks=184796420 --metrics-shmem-handle=3420,i,10629958212753408065,904072932574815956,2097152 --field-trial-handle=2052,i,12847949457923763407,11722859483185275525,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2044,i,5151719473677860865,1677759856349050304,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3436 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780016941285038 --launch-time-ticks=184804229 --metrics-shmem-handle=3496,i,18260018984951801129,18262197752152796310,2097152 --field-trial-handle=2052,i,12847949457923763407,11722859483185275525,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2044,i,5151719473677860865,1677759856349050304,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3524 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780016941285038 --launch-time-ticks=184883428 --metrics-shmem-handle=4020,i,16434622060008991671,3723310556216360471,2097152 --field-trial-handle=2052,i,12847949457923763407,11722859483185275525,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2044,i,5151719473677860865,1677759856349050304,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=3860 /prefetch:2
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=148.0.7778.217 --initial-client-data=0x268,0x26c,0x270,0x24c,0x274,0x7fff17d7e9c0,0x7fff17d7e9cc,0x7fff17d7e9d8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1864,i,5482176214925103913,9705694517824787131,262144 --field-trial-handle=1944,i,7093473847080856819,2154877408690973068,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2040,i,17649336302459098073,5089247004046575025,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1960 /prefetch:2
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=2180,i,13977324444394696406,12262339251906797757,524288 --field-trial-handle=1944,i,7093473847080856819,2154877408690973068,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2040,i,17649336302459098073,5089247004046575025,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2304 /prefetch:3
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --metrics-shmem-handle=2432,i,7925423931179314297,3475023120351615237,524288 --field-trial-handle=1944,i,7093473847080856819,2154877408690973068,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2040,i,17649336302459098073,5089247004046575025,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2464 /prefetch:8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=188220001 --metrics-shmem-handle=3408,i,17250958244889441672,16955464533395623964,2097152 --field-trial-handle=1944,i,7093473847080856819,2154877408690973068,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2040,i,17649336302459098073,5089247004046575025,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3428 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=188235570 --metrics-shmem-handle=3476,i,96041082258559758,561555243266559418,2097152 --field-trial-handle=1944,i,7093473847080856819,2154877408690973068,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2040,i,17649336302459098073,5089247004046575025,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3508 /prefetch:1
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff17aa5d58,0x7fff17aa5d64,0x7fff17aa5d70
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2276,i,1019290859366143219,474471981762178162,524288 --field-trial-handle=2536,i,11724614692308454368,3527282999281465153,262144 --variations-seed-version --pseudonymization-salt-handle=2540,i,6336970065135432219,6086627356096345128,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2928 /prefetch:3
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2140,i,4796579470716125924,3583009602599437845,262144 --field-trial-handle=2536,i,11724614692308454368,3527282999281465153,262144 --variations-seed-version --pseudonymization-salt-handle=2540,i,6336970065135432219,6086627356096345128,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2512 /prefetch:2
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2592,i,5114407613783052329,12189494512828204606,524288 --field-trial-handle=2536,i,11724614692308454368,3527282999281465153,262144 --variations-seed-version --pseudonymization-salt-handle=2540,i,6336970065135432219,6086627356096345128,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3060 /prefetch:8
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=188075657 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3548,i,4951949559884275529,3240854800306246667,2097152 --field-trial-handle=2536,i,11724614692308454368,3527282999281465153,262144 --variations-seed-version --pseudonymization-salt-handle=2540,i,6336970065135432219,6086627356096345128,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3560 /prefetch:1
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=188078218 --skip-read-main-dll --metrics-shmem-handle=3600,i,7188452913418869293,5974290332555668644,2097152 --field-trial-handle=2536,i,11724614692308454368,3527282999281465153,262144 --variations-seed-version --pseudonymization-salt-handle=2540,i,6336970065135432219,6086627356096345128,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3704 /prefetch:1
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=190439634 --skip-read-main-dll --metrics-shmem-handle=4340,i,2035145559628390302,15234815998672309012,2097152 --field-trial-handle=2536,i,11724614692308454368,3527282999281465153,262144 --variations-seed-version --pseudonymization-salt-handle=2540,i,6336970065135432219,6086627356096345128,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5492 /prefetch:1
  • "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=148.0.7778.217 --initial-client-data=0x274,0x278,0x27c,0x22c,0x280,0x7fff13c9e9c0,0x7fff13c9e9cc,0x7fff13c9e9d8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1860,i,3300367939128472063,1109909737383181549,262144 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1996 /prefetch:2
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=2220,i,4292391152267630290,17044528089172028308,524288 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2316 /prefetch:3
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --metrics-shmem-handle=2428,i,2870240190880711214,15086914526539483698,524288 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2448 /prefetch:8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=193780146 --metrics-shmem-handle=3408,i,17791338471366969995,1322070823601272411,2097152 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3424 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=193786448 --metrics-shmem-handle=3480,i,15860247191428090499,6877187108849994818,2097152 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3496 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=193865715 --metrics-shmem-handle=3972,i,15901504149094471461,13122646591548346961,2097152 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4000 /prefetch:2
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=196472411 --metrics-shmem-handle=5104,i,14576742718486585882,15948514611312867252,2097152 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4084 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --metrics-shmem-handle=5464,i,919148309293356251,17126725834715816901,524288 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5260 /prefetch:8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=5568,i,15007537538287073319,5395734452898607708,524288 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5724 /prefetch:8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=199301059 --metrics-shmem-handle=6108,i,16693674516094360180,15408437999661042024,2097152 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5968 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=12 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=200813849 --metrics-shmem-handle=5944,i,17695216781716197494,16003354653199246969,2097152 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3512 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=13 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=201942625 --metrics-shmem-handle=3460,i,14403599812438798326,8762206743836934499,2097152 --field-trial-handle=2020,i,11753304529539327351,830513645079642620,262144 --variations-seed-version=20260528-010044.458000-production --pseudonymization-salt-handle=2032,i,11601081463191439736,13193134760479235573,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=6308 /prefetch:1
  • C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  • C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
  • "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
  • C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  • C:\Windows\system32\OpenWith.exe -Embedding
  • "C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe" -ServerName:App.AppXk7vvv12h4qrkhkbvf6j86ja45mzj5km9.mca
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update
  • C:\Windows\system32\svchost.exe -k netsvcs -p
  • "C:\Program Files\Google\Chrome\Application\148.0.7778.217\elevation_service.exe"
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --system --windows-service --service=update-internal
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2f8,0xe08584,0xe08590,0xe0859c
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=148.0.7778.217 --initial-client-data=0x268,0x26c,0x270,0x228,0x274,0x7fff13b8e9c0,0x7fff13b8e9cc,0x7fff13b8e9d8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1896,i,1965219625233871580,15761649738141911700,262144 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1744 /prefetch:2
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=2220,i,240852781398081202,11781034939987490107,524288 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2332 /prefetch:3
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --metrics-shmem-handle=2432,i,13694897044950108372,5916141248398836148,524288 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2496 /prefetch:8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=318307439 --metrics-shmem-handle=3432,i,16598252950463734429,11399949408287476259,2097152 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3472 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=318319916 --metrics-shmem-handle=3520,i,13131168954376319020,17307178636095154358,2097152 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3548 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=7 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=318473457 --metrics-shmem-handle=4028,i,9236156418739086950,7250927946557259860,2097152 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4048 /prefetch:2
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=318504101 --metrics-shmem-handle=4224,i,11515181480494906179,2020787613431213393,2097152 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4256 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=318572212 --metrics-shmem-handle=4384,i,6030069453497651807,10150761954587221439,2097152 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4464 /prefetch:2
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=10 --time-ticks-at-unix-epoch=-1780016941285037 --launch-time-ticks=319125153 --metrics-shmem-handle=3456,i,8531487779622254277,14984965549206052235,2097152 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5044 /prefetch:1
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --metrics-shmem-handle=5256,i,9215147652206203195,17185671723445978258,524288 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5496 /prefetch:8
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --wake-all --system
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --metrics-shmem-handle=4672,i,9788554439081694749,6699556474976917040,524288 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4576 /prefetch:8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --metrics-shmem-handle=6428,i,13399593810988296299,7184301733000042042,524288 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=584 /prefetch:8
  • "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --metrics-shmem-handle=4268,i,6026064117647493318,7261643350697586625,524288 --field-trial-handle=1416,i,14348267100856235506,13841380491515774765,262144 --variations-seed-version --pseudonymization-salt-handle=1556,i,25414569426475615,1956004206372909168,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4756 /prefetch:8
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2d8,0x2dc,0x2e0,0x2d4,0x2e4,0xe08584,0xe08590,0xe0859c
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2e8,0x2ec,0x2f0,0x2e4,0x2f4,0xe08584,0xe08590,0xe0859c
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --wake --system
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2e8,0x2ec,0x2d8,0x2e4,0x2dc,0xe08584,0xe08590,0xe0859c
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2ec,0xe08584,0xe08590,0xe0859c
  • "C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\149.0.7814.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=149.0.7814.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2e0,0x2a8,0x2ac,0x2dc,0x2d8,0xe08584,0xe08590,0xe0859c
  • Local\__DDrawCheckExclMode__
  • Local\MSCTF.Asm.MutexDefault1
  • CicLoadWinStaWinSta0
  • Local\MSCTF.CtfMonitorInstMutexDefault1
  • DefaultTabtip-MainUI
  • Local\Mutex5f7b5f1e01b83767.automaticDestinations-ms
  • Local\Mutexf01b4d95cf55d32a.automaticDestinations-ms
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_16.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_32.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_48.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_96.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_256.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_768.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1280.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1920.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_2560.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_sr.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_wide.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_exif.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_wide_alternate.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_custom_stream.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!ThumbnailCacheInit
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs
  • Local\Shell.CMruPidlList
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!4230
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!150c8
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!418
  • Local\InternetShortcutMutex
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!4684
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!4a0
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!478c
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!4734
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!45d4
  • Global\C::Users:admin:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!462c
  • NarratorRunning
  • _!SHMSFTHISTORY!_
  • Local\SM0:4484:304:WilStaging_02
  • Local\Shell_LightDismissOverlay_Sync
  • Local\SM0:4484:120:WilError_03
  • Global\G{D8E4A6FE-EA7A-4D20-A8C8-B4628776A101}
  • __OMADM_NAMED_MUTEX__
  • Local\SM0:12464:120:WilError_03
  • Local\SM0:12464:304:WilStaging_02
  • Local\SM0:8820:304:WilStaging_02
  • Local\SM0:35776:304:WilStaging_02
  • Local\SM0:35776:120:WilError_03
  • Local\SessionImmersiveColorMutex
  • Global\Windows.Machine.OOBE
  • Local\SM0:36380:304:WilStaging_02
  • Local\SM0:51244:304:WilStaging_02
  • Local\SM0:56408:168:WilStaging_02
  • Local\SM0:56972:168:WilStaging_02
  • GoogleUpdaterService149.0.7814.0
  • GoogleChromeElevationService
  • GoogleUpdaterInternalService149.0.7814.0
  • AppMgmt

No results found.

No behavioral analysis data available.

Sorry! No strace.
Sorry! No tracee.
Hosts
No hosts contacted.
TCP Connections
No TCP connections recorded.
UDP Connections
No UDP connections recorded.
DNS Requests
No domains contacted.
HTTP Requests
No HTTP(s) requests performed.
SMTP Traffic
No SMTP traffic performed.
IRC Traffic
No IRC requests performed.
ICMP Traffic
No ICMP traffic performed.
CIF Results
No CIF Results
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
Suricata HTTP
No Suricata HTTP
Sorry! No Suricata Extracted files.

No dropped files found.

No CAPE payloads found.

Sorry! No process dumps.