Analysis Report · CAPE Sandbox

Analysis Details

Category	Package	Started	Completed	Duration	Options	Logs
URL	edge	2026-05-29 06:44:05	2026-05-29 06:47:47	222s
Reports	JSON

Options

interactive=1
nohuman=yes
vnc_port=5910

Analysis Log

2026-05-28 20:55:31,182 [root] INFO: Date set to: 20260529T06:44:12, timeout set to: 200
2026-05-29 06:44:12,055 [root] DEBUG: Starting analyzer from: C:\lpw_albt
2026-05-29 06:44:12,057 [root] DEBUG: Storing results at: C:\gZRInK
2026-05-29 06:44:12,058 [root] DEBUG: Pipe server name: \\.\PIPE\AMUWJCJPH
2026-05-29 06:44:12,058 [root] DEBUG: Python path: C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64
2026-05-29 06:44:12,058 [root] INFO: analysis running as an admin
2026-05-29 06:44:12,059 [root] INFO: analysis package specified: "edge"
2026-05-29 06:44:12,059 [root] DEBUG: importing analysis package module: "modules.packages.edge"...
2026-05-29 06:44:12,065 [root] DEBUG: imported analysis package "edge"
2026-05-29 06:44:12,066 [root] DEBUG: initializing analysis package "edge"...
2026-05-29 06:44:12,066 [root] DEBUG: New location of moved file: https://badoomovies.com/download/BadooMovies.exe
2026-05-29 06:44:12,070 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option
2026-05-29 06:44:12,072 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option
2026-05-29 06:44:12,072 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option
2026-05-29 06:44:12,074 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option
2026-05-29 06:44:12,133 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-05-29 06:44:12,201 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-05-29 06:44:12,216 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-05-29 06:44:12,225 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-05-29 06:44:12,231 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-05-29 06:44:12,232 [lib.api.screenshot] ERROR: No module named 'PIL'
2026-05-29 06:44:12,233 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-05-29 06:44:12,242 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-05-29 06:44:12,243 [root] DEBUG: Initialized auxiliary module "Browser"
2026-05-29 06:44:12,244 [root] DEBUG: attempting to configure 'Browser' from data
2026-05-29 06:44:12,245 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-05-29 06:44:12,245 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-05-29 06:44:12,246 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-05-29 06:44:12,246 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-05-29 06:44:12,246 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-05-29 06:44:12,247 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-05-29 06:44:12,247 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-05-29 06:44:12,247 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file
2026-05-29 06:44:12,247 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig
2026-05-29 06:44:12,248 [root] DEBUG: Initialized auxiliary module "Disguise"
2026-05-29 06:44:12,248 [root] DEBUG: attempting to configure 'Disguise' from data
2026-05-29 06:44:12,248 [root] DEBUG: module Disguise does not support data configuration, ignoring
2026-05-29 06:44:12,248 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.disguise"...
2026-05-29 06:44:12,261 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 1028)
2026-05-29 06:44:12,261 [modules.auxiliary.disguise] INFO: Disguising GUID to 1fe1aae4-9186-4225-a287-b753d9a30a59
2026-05-29 06:44:12,262 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise
2026-05-29 06:44:12,262 [root] DEBUG: Initialized auxiliary module "Human"
2026-05-29 06:44:12,262 [root] DEBUG: attempting to configure 'Human' from data
2026-05-29 06:44:12,262 [root] DEBUG: module Human does not support data configuration, ignoring
2026-05-29 06:44:12,263 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.human"...
2026-05-29 06:44:12,263 [root] DEBUG: Started auxiliary module modules.auxiliary.human
2026-05-29 06:44:12,263 [root] DEBUG: Initialized auxiliary module "Screenshots"
2026-05-29 06:44:12,264 [root] DEBUG: attempting to configure 'Screenshots' from data
2026-05-29 06:44:12,264 [root] DEBUG: module Screenshots does not support data configuration, ignoring
2026-05-29 06:44:12,264 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.screenshots"...
2026-05-29 06:44:12,264 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled
2026-05-29 06:44:12,264 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots
2026-05-29 06:44:12,265 [root] DEBUG: Initialized auxiliary module "TLSDumpMasterSecrets"
2026-05-29 06:44:12,265 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data
2026-05-29 06:44:12,265 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring
2026-05-29 06:44:12,265 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.tlsdump"...
2026-05-29 06:44:12,267 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process
2026-05-29 06:44:12,267 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump
2026-05-29 06:44:12,267 [root] INFO: Interactive mode enabled - injecting into explorer shell
2026-05-29 06:44:12,358 [lib.api.process] INFO: Monitor config for process 4484: C:\lpw_albt\dll\4484.ini
2026-05-29 06:44:12,359 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:12,362 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:12,412 [root] DEBUG: Loader: Injecting process 4484 with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:12,584 [root] DEBUG: 4484: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:44:12,586 [root] DEBUG: 4484: Disabling sleep skipping.
2026-05-29 06:44:12,588 [root] DEBUG: 4484: Interactive desktop enabled.
2026-05-29 06:44:12,589 [root] DEBUG: 4484: Dropped file limit defaulting to 100.
2026-05-29 06:44:12,591 [root] DEBUG: 4484: Interactive desktop - injecting Explorer Shell
2026-05-29 06:44:12,612 [root] DEBUG: 4484: YaraInit: Compiled 44 rule files
2026-05-29 06:44:12,615 [root] DEBUG: 4484: YaraInit: Compiled rules saved to file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:44:12,666 [root] DEBUG: 4484: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:44:12,668 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316
2026-05-29 06:44:12,723 [root] DEBUG: 4484: Monitor initialised: 64-bit capemon loaded in process 4484 at 0x00007FFF18240000, thread 1276, image base 0x00007FF79BC10000, stack from 0x0000000009051000-0x0000000009060000
2026-05-29 06:44:12,724 [root] DEBUG: 4484: Commandline: C:\Windows\Explorer.EXE
2026-05-29 06:44:12,740 [root] DEBUG: 4484: Hooked 69 out of 69 functions
2026-05-29 06:44:12,773 [root] DEBUG: 4484: Syscall hook installed, syscall logging level 1
2026-05-29 06:44:12,781 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-29 06:44:12,782 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:12,783 [lib.api.process] INFO: Injected into 64-bit <Process 4484 explorer.exe>
2026-05-29 06:44:13,366 [root] DEBUG: 4484: caller_dispatch: Added region at 0x00007FF79BC10000 to tracked regions list (ntdll::NtCreateFile returns to 0x00007FF79BD27BE7, thread 4696).
2026-05-29 06:44:13,367 [root] DEBUG: 4484: YaraScan: Scanning 0x00007FF79BC10000, size 0x545316
2026-05-29 06:44:13,401 [root] DEBUG: 4484: ProcessImageBase: Main module image at 0x00007FF79BC10000 unmodified (entropy change 0.000000e+00)
2026-05-29 06:44:19,933 [root] INFO: Restarting WMI Service
2026-05-29 06:44:19,952 [root] DEBUG: package modules.packages.edge does not support configure, ignoring
2026-05-29 06:44:19,953 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'
2026-05-29 06:44:19,953 [lib.core.compound] INFO: C:\Users\admin\AppData\Local\Temp already exists, skipping creation
2026-05-29 06:44:19,954 [lib.api.process] INFO: Successfully executed process from path "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" with arguments ""https://badoomovies.com/download/BadooMovies.exe"" with pid 4104
2026-05-29 06:44:19,955 [lib.api.process] INFO: Monitor config for process 4104: C:\lpw_albt\dll\4104.ini
2026-05-29 06:44:19,957 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:19,958 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:19,965 [root] DEBUG: Loader: Injecting process 4104 (thread 4828) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:19,965 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:19,966 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:19,967 [lib.api.process] INFO: Injected into 64-bit <Process 4104 msedge.exe>
2026-05-29 06:44:21,971 [lib.api.process] INFO: Successfully resumed process with pid 4104
2026-05-29 06:44:22,017 [root] DEBUG: 4104: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:44:22,019 [root] DEBUG: 4104: Disabling sleep skipping.
2026-05-29 06:44:22,019 [root] DEBUG: 4104: Interactive desktop enabled.
2026-05-29 06:44:22,020 [root] DEBUG: 4104: Dropped file limit defaulting to 100.
2026-05-29 06:44:22,027 [root] DEBUG: 4104: Edge-specific hook-set enabled.
2026-05-29 06:44:22,030 [root] DEBUG: 4104: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:44:22,041 [root] DEBUG: 4104: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:44:22,041 [root] DEBUG: 4104: Monitor initialised: 64-bit capemon loaded in process 4104 at 0x00007FFF18240000, thread 4828, image base 0x00007FF7F5380000, stack from 0x000000F49FFF4000-0x000000F4A0000000
2026-05-29 06:44:22,041 [root] DEBUG: 4104: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://badoomovies.com/download/BadooMovies.exe"
2026-05-29 06:44:22,052 [root] DEBUG: 4104: Hooked 2 out of 2 functions
2026-05-29 06:44:22,087 [root] DEBUG: 4104: Syscall hook installed, syscall logging level 1
2026-05-29 06:44:22,093 [root] DEBUG: 4104: RestoreHeaders: Restored original import table.
2026-05-29 06:44:22,094 [root] INFO: Loaded monitor into process with pid 4104
2026-05-29 06:44:22,097 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-29 06:44:22,102 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43500000: C:\Windows\SYSTEM32\version (0xa000 bytes).
2026-05-29 06:44:22,103 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-29 06:44:22,104 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\Wldp (0x2d000 bytes).
2026-05-29 06:44:22,104 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-29 06:44:22,105 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\SHCORE (0xad000 bytes).
2026-05-29 06:44:22,106 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:44:22,277 [root] DEBUG: 4104: DLL loaded at 0x00007FFF453C0000: C:\Windows\SYSTEM32\WINMM (0x27000 bytes).
2026-05-29 06:44:22,278 [root] DEBUG: 4104: DLL loaded at 0x00007FFEFE540000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge (0x136be000 bytes).
2026-05-29 06:44:22,281 [root] DEBUG: 4104: DLL loaded at 0x00007FFF45010000: C:\Windows\SYSTEM32\KBDUS (0x9000 bytes).
2026-05-29 06:44:22,284 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-29 06:44:22,289 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-29 06:44:22,290 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 1204: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:22,290 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-29 06:44:22,290 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1204
2026-05-29 06:44:22,291 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3E220000: C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).
2026-05-29 06:44:22,291 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1204
2026-05-29 06:44:22,292 [root] DEBUG: 4104: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:44:22,292 [root] DEBUG: 4104: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:44:22,296 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57520000: C:\Windows\SYSTEM32\USERENV (0x2e000 bytes).
2026-05-29 06:44:22,297 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55EC0000: C:\Windows\SYSTEM32\gpapi (0x23000 bytes).
2026-05-29 06:44:22,297 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56750000: C:\Windows\SYSTEM32\wkscli (0x19000 bytes).
2026-05-29 06:44:22,298 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56A30000: C:\Windows\SYSTEM32\netutils (0xc000 bytes).
2026-05-29 06:44:22,299 [root] DEBUG: 4104: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:44:22,301 [root] DEBUG: 4104: DLL loaded at 0x00007FFF16A40000: C:\Windows\SYSTEM32\MDMRegistration (0x68000 bytes).
2026-05-29 06:44:22,302 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:44:22,303 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-29 06:44:22,303 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57010000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-29 06:44:22,304 [root] DEBUG: 4104: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:44:22,304 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-29 06:44:22,304 [root] DEBUG: 4104: DLL loaded at 0x00007FFF15300000: C:\Windows\SYSTEM32\DMCmnUtils (0x7c000 bytes).
2026-05-29 06:44:22,305 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3F6A0000: C:\Windows\SYSTEM32\omadmapi (0x3a000 bytes).
2026-05-29 06:44:22,305 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-29 06:44:22,306 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56FD0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-29 06:44:22,308 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43550000: C:\Windows\SYSTEM32\netapi32 (0x19000 bytes).
2026-05-29 06:44:22,309 [root] DEBUG: 4104: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:44:22,309 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-29 06:44:22,309 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52F20000: C:\Windows\SYSTEM32\DSREG (0x141000 bytes).
2026-05-29 06:44:22,311 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57560000: C:\Windows\SYSTEM32\profapi (0x25000 bytes).
2026-05-29 06:44:22,319 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CFA0000: C:\Windows\System32\AssignedAccessRuntime (0x14000 bytes).
2026-05-29 06:44:22,321 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-29 06:44:22,321 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4D3D0000: C:\Windows\System32\SystemSettings.DataModel (0x74000 bytes).
2026-05-29 06:44:22,322 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:44:22,323 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57470000: C:\Windows\SYSTEM32\UMPDC (0x12000 bytes).
2026-05-29 06:44:22,324 [root] DEBUG: 4104: DLL loaded at 0x00007FFF49A90000: C:\Windows\SYSTEM32\DWrite (0x27f000 bytes).
2026-05-29 06:44:22,327 [root] DEBUG: 4104: DLL loaded at 0x00007FFF44D50000: C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\COMCTL32 (0x29a000 bytes).
2026-05-29 06:44:22,328 [root] DEBUG: 4104: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-29 06:44:22,328 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57350000: C:\Windows\SYSTEM32\DPAPI (0xa000 bytes).
2026-05-29 06:44:22,330 [root] DEBUG: 4104: DLL loaded at 0x00007FFF569F0000: C:\Windows\SYSTEM32\IPHLPAPI (0x3b000 bytes).
2026-05-29 06:44:22,330 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52960000: C:\Windows\system32\NLAapi (0x1d000 bytes).
2026-05-29 06:44:22,332 [root] DEBUG: 4104: DLL loaded at 0x00007FFF58B20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-29 06:44:22,333 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-29 06:44:22,334 [root] DEBUG: 4104: DLL loaded at 0x00007FFF515C0000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x17000 bytes).
2026-05-29 06:44:22,334 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4B070000: C:\Windows\System32\StructuredQuery (0xa6000 bytes).
2026-05-29 06:44:22,335 [root] DEBUG: 4104: DLL loaded at 0x00007FFF515A0000: C:\Windows\SYSTEM32\dhcpcsvc (0x1d000 bytes).
2026-05-29 06:44:22,336 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52860000: C:\Windows\SYSTEM32\PROPSYS (0xf6000 bytes).
2026-05-29 06:44:22,337 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56A40000: C:\Windows\SYSTEM32\DNSAPI (0xca000 bytes).
2026-05-29 06:44:22,339 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CBF0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-29 06:44:22,342 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-29 06:44:22,342 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-29 06:44:22,342 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54170000: C:\Windows\System32\CoreUIComponents (0x35b000 bytes).
2026-05-29 06:44:22,343 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4B680000: C:\Windows\SYSTEM32\textinputframework (0xf9000 bytes).
2026-05-29 06:44:22,345 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CD70000: C:\Windows\system32\Windows.Storage.Search (0xc6000 bytes).
2026-05-29 06:44:22,348 [root] DEBUG: 4104: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-29 06:44:22,349 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CD40000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-05-29 06:44:22,350 [root] DEBUG: 4104: DLL loaded at 0x00007FFF45580000: C:\Windows\system32\twinapi (0xa9000 bytes).
2026-05-29 06:44:22,353 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52420000: C:\Windows\SYSTEM32\wevtapi (0x65000 bytes).
2026-05-29 06:44:22,353 [root] DEBUG: 4104: DLL loaded at 0x00007FFF47AB0000: C:\Windows\SYSTEM32\edputil (0x24000 bytes).
2026-05-29 06:44:22,357 [root] DEBUG: 4104: DLL loaded at 0x00007FFF51A60000: C:\Windows\System32\WindowManagementAPI (0xa1000 bytes).
2026-05-29 06:44:22,357 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4AF10000: C:\Windows\System32\InputHost (0x152000 bytes).
2026-05-29 06:44:22,357 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4BFB0000: C:\Windows\System32\Windows.UI (0x141000 bytes).
2026-05-29 06:44:22,358 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4D6A0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-29 06:44:22,359 [root] DEBUG: 4104: DLL loaded at 0x00007FFF47980000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-05-29 06:44:22,360 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\WTSAPI32 (0x14000 bytes).
2026-05-29 06:44:22,368 [root] DEBUG: 4104: DLL loaded at 0x00007FFF515E0000: C:\Windows\SYSTEM32\ColorAdapterClient (0x11000 bytes).
2026-05-29 06:44:22,369 [root] DEBUG: 4104: DLL loaded at 0x00007FFF51600000: C:\Windows\SYSTEM32\mscms (0xae000 bytes).
2026-05-29 06:44:22,370 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-29 06:44:22,373 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52560000: C:\Windows\SYSTEM32\WINHTTP (0x10a000 bytes).
2026-05-29 06:44:22,385 [root] DEBUG: 4104: DLL loaded at 0x00007FFF15A80000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\oneauth (0x5c4000 bytes).
2026-05-29 06:44:22,389 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 2168: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:22,390 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 2168
2026-05-29 06:44:22,391 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 2168
2026-05-29 06:44:22,393 [root] DEBUG: 4104: caller_dispatch: Added region at 0x00007FF7F5380000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF7F5477D66, thread 8576).
2026-05-29 06:44:22,394 [root] DEBUG: 4104: DLL loaded at 0x00007FFF48330000: C:\Windows\SYSTEM32\Secur32 (0xc000 bytes).
2026-05-29 06:44:22,396 [root] DEBUG: 4104: DLL loaded at 0x00007FFF49D10000: C:\Windows\System32\Windows.UI.Immersive (0x139000 bytes).
2026-05-29 06:44:22,398 [root] DEBUG: 4104: ProcessImageBase: Main module image at 0x00007FF7F5380000 unmodified (entropy change 0.000000e+00)
2026-05-29 06:44:22,400 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 1332: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:22,400 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1332
2026-05-29 06:44:22,401 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1332
2026-05-29 06:44:22,405 [root] DEBUG: 4104: DLL loaded at 0x00007FFF573C0000: C:\Windows\SYSTEM32\sxs (0xa2000 bytes).
2026-05-29 06:44:22,411 [root] DEBUG: 4104: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-29 06:44:22,412 [root] DEBUG: 4104: DLL loaded at 0x00007FFF409A0000: C:\Windows\System32\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).
2026-05-29 06:44:22,421 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 4760: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:22,421 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43590000: C:\Windows\SYSTEM32\LINKINFO (0xd000 bytes).
2026-05-29 06:44:22,423 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 4760
2026-05-29 06:44:22,426 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 4760
2026-05-29 06:44:22,470 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55EF0000: C:\Windows\system32\dxgi (0xf3000 bytes).
2026-05-29 06:44:22,471 [root] DEBUG: 4104: DLL loaded at 0x00007FFF53070000: C:\Windows\system32\d3d11 (0x263000 bytes).
2026-05-29 06:44:22,471 [root] DEBUG: 4104: DLL loaded at 0x00007FFF538A0000: C:\Windows\system32\dcomp (0x1e3000 bytes).
2026-05-29 06:44:22,472 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43630000: C:\Windows\system32\dataexchange (0x3e000 bytes).
2026-05-29 06:44:22,498 [root] DEBUG: 4104: DLL loaded at 0x00007FFF18950000: C:\Windows\System32\Windows.System.Profile.RetailInfo (0x28000 bytes).
2026-05-29 06:44:22,514 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55220000: C:\Windows\SYSTEM32\dwmapi (0x2f000 bytes).
2026-05-29 06:44:22,521 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43990000: C:\Windows\SYSTEM32\OLEACC (0x66000 bytes).
2026-05-29 06:44:22,522 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 4108: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:22,523 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 5820: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:22,523 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 4108
2026-05-29 06:44:22,523 [root] DEBUG: 4104: DLL loaded at 0x00007FFF488B0000: C:\Windows\system32\directmanipulation (0x9d000 bytes).
2026-05-29 06:44:22,524 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 5820
2026-05-29 06:44:22,524 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 4108
2026-05-29 06:44:22,525 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 5820
2026-05-29 06:44:22,598 [root] DEBUG: 4104: DLL loaded at 0x00007FFF456D0000: C:\Windows\System32\Windows.Security.Authentication.Web.Core (0x11d000 bytes).
2026-05-29 06:44:22,603 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3F8A0000: C:\Windows\SYSTEM32\VCRUNTIME140 (0x1e000 bytes).
2026-05-29 06:44:22,604 [root] DEBUG: 4104: DLL loaded at 0x00007FFF42BF0000: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions (0x17000 bytes).
2026-05-29 06:44:22,606 [root] DEBUG: 4104: DLL loaded at 0x00007FFF16390000: C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Well Known Domains\1.2.0.0\well_known_domains (0x9e000 bytes).
2026-05-29 06:44:22,617 [root] DEBUG: 4104: DLL loaded at 0x00007FFF48780000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-29 06:44:22,620 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3E730000: C:\Windows\System32\vaultcli (0x51000 bytes).
2026-05-29 06:44:22,627 [root] DEBUG: 4104: DLL loaded at 0x00007FFF16350000: C:\Windows\System32\aadWamExtension (0x36000 bytes).
2026-05-29 06:44:22,635 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57130000: C:\Windows\SYSTEM32\MSASN1 (0x12000 bytes).
2026-05-29 06:44:22,637 [root] DEBUG: 4104: DLL loaded at 0x00007FFF162C0000: C:\Windows\System32\MicrosoftAccountWAMExtension (0x8c000 bytes).
2026-05-29 06:44:22,639 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\CRYPTSP (0x18000 bytes).
2026-05-29 06:44:22,641 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56630000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-29 06:44:23,883 [root] DEBUG: 4104: DLL loaded at 0x00007FFF3FD40000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-29 06:44:24,304 [root] DEBUG: 4104: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:44:24,306 [root] DEBUG: 4104: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:44:27,545 [root] DEBUG: 4104: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\SETUPAPI (0x46e000 bytes).
2026-05-29 06:44:27,551 [root] DEBUG: 4104: DLL loaded at 0x00007FFF572F0000: C:\Windows\SYSTEM32\DEVOBJ (0x33000 bytes).
2026-05-29 06:44:27,556 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 9328: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:27,558 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54B30000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-05-29 06:44:27,562 [root] DEBUG: 4104: DLL loaded at 0x00007FFF54B30000: C:\Windows\System32\netprofm (0x3f000 bytes).
2026-05-29 06:44:27,566 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57AA0000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-29 06:44:27,574 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 9344: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:27,582 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 9328
2026-05-29 06:44:27,588 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 9344
2026-05-29 06:44:27,590 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 9344
2026-05-29 06:44:27,653 [root] DEBUG: 4104: DLL loaded at 0x00007FFEFB560000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\telclient (0x3ed000 bytes).
2026-05-29 06:44:27,865 [root] DEBUG: 4104: DLL loaded at 0x00007FFF164C0000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\ffmpeg (0x467000 bytes).
2026-05-29 06:44:27,866 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4F560000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-05-29 06:44:27,903 [root] DEBUG: 4104: DLL loaded at 0x00007FFEFAF00000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\oneds (0x33f000 bytes).
2026-05-29 06:44:28,069 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56250000: C:\Windows\System32\FirewallAPI (0x96000 bytes).
2026-05-29 06:44:28,070 [root] DEBUG: 4104: DLL loaded at 0x00007FFF561E0000: C:\Windows\System32\fwbase (0x36000 bytes).
2026-05-29 06:44:28,077 [root] DEBUG: 4104: DLL loaded at 0x00007FFF12EB0000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\microsoft_shell_integration (0x78000 bytes).
2026-05-29 06:44:28,113 [root] DEBUG: 4104: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-29 06:44:28,114 [root] DEBUG: 4104: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-29 06:44:28,115 [root] DEBUG: 4104: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-29 06:44:28,681 [root] DEBUG: 4104: DLL loaded at 0x00007FFF150C0000: C:\Windows\system32\TenantRestrictionsPlugin (0x1b000 bytes).
2026-05-29 06:44:28,719 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 9528: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe, ImageBase: 0x00007FF6C7670000
2026-05-29 06:44:28,721 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9528
2026-05-29 06:44:28,722 [lib.api.process] INFO: Monitor config for process 9528: C:\lpw_albt\dll\9528.ini
2026-05-29 06:44:28,725 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:30,107 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-29 06:44:30,107 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll
2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll
2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll
2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll
2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll
2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-29 06:44:30,108 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll
2026-05-29 06:44:30,112 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:30,116 [root] DEBUG: Loader: Injecting process 9528 (thread 9532) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:30,117 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:30,117 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:30,120 [lib.api.process] INFO: Injected into 64-bit <Process 9528 identity_helper.exe>
2026-05-29 06:44:30,139 [root] DEBUG: 4104: DLL loaded at 0x00007FFF501A0000: C:\Windows\SYSTEM32\capauthz (0x51000 bytes).
2026-05-29 06:44:30,140 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4CBD0000: C:\Windows\SYSTEM32\windows.staterepositorycore (0x11000 bytes).
2026-05-29 06:44:30,141 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 9656: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe, ImageBase: 0x00007FF6C7670000
2026-05-29 06:44:30,142 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9656
2026-05-29 06:44:30,142 [lib.api.process] INFO: Monitor config for process 9656: C:\lpw_albt\dll\9656.ini
2026-05-29 06:44:30,143 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:30,231 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-29 06:44:30,231 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll
2026-05-29 06:44:30,232 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll
2026-05-29 06:44:30,232 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll
2026-05-29 06:44:30,233 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll
2026-05-29 06:44:30,233 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll
2026-05-29 06:44:30,233 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-29 06:44:30,233 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll
2026-05-29 06:44:30,235 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:30,241 [root] DEBUG: Loader: Injecting process 9656 (thread 9660) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:30,241 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:30,242 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:30,243 [lib.api.process] INFO: Injected into 64-bit <Process 9656 identity_helper.exe>
2026-05-29 06:44:30,247 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 9656
2026-05-29 06:44:30,247 [lib.api.process] INFO: Monitor config for process 9656: C:\lpw_albt\dll\9656.ini
2026-05-29 06:44:30,248 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:30,325 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll
2026-05-29 06:44:30,325 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140_1.dll
2026-05-29 06:44:30,326 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4F950000: C:\Windows\system32\wlanapi (0x74000 bytes).
2026-05-29 06:44:30,326 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vccorlib140.dll
2026-05-29 06:44:30,326 [lib.api.process] INFO: Potential dll side-loading detected in local directory: concrt140.dll
2026-05-29 06:44:30,326 [lib.api.process] INFO: Potential dll side-loading detected in local directory: vcruntime140.dll
2026-05-29 06:44:30,327 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140.dll
2026-05-29 06:44:30,327 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll
2026-05-29 06:44:30,327 [lib.api.process] INFO: Potential dll side-loading detected in local directory: msvcp140_codecvt_ids.dll
2026-05-29 06:44:30,328 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:30,332 [root] DEBUG: Loader: Injecting process 9656 (thread 9660) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:30,334 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:44:30,334 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:30,337 [lib.api.process] INFO: Injected into 64-bit <Process 9656 identity_helper.exe>
2026-05-29 06:44:30,351 [root] DEBUG: 9656: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:44:30,351 [root] DEBUG: 9656: Interactive desktop enabled.
2026-05-29 06:44:30,352 [root] DEBUG: 9656: Dropped file limit defaulting to 100.
2026-05-29 06:44:30,362 [root] DEBUG: 9656: Disabling sleep skipping.
2026-05-29 06:44:30,364 [root] DEBUG: 9656: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:44:30,376 [root] DEBUG: 9656: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:44:30,377 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8
2026-05-29 06:44:30,406 [root] DEBUG: 9656: Monitor initialised: 64-bit capemon loaded in process 9656 at 0x00007FFF18240000, thread 9660, image base 0x00007FF6C7670000, stack from 0x000000FC372F4000-0x000000FC37300000
2026-05-29 06:44:30,407 [root] DEBUG: 9656: Commandline: "C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,1199331602286409
2026-05-29 06:44:30,407 [root] DEBUG: 9656: add_all_dlls_to_dll_ranges: skipping C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge_elf.dll
2026-05-29 06:44:30,419 [root] DEBUG: 9656: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-29 06:44:30,445 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-29 06:44:30,446 [root] DEBUG: 9656: set_hooks: Unable to hook LockResource
2026-05-29 06:44:30,451 [root] DEBUG: 9656: Hooked 627 out of 628 functions
2026-05-29 06:44:30,467 [root] DEBUG: 9656: Syscall hook installed, syscall logging level 1
2026-05-29 06:44:30,473 [root] DEBUG: 9656: RestoreHeaders: Restored original import table.
2026-05-29 06:44:30,474 [root] INFO: Loaded monitor into process with pid 9656
2026-05-29 06:44:30,475 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994
2026-05-29 06:44:30,549 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994
2026-05-29 06:44:30,578 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994
2026-05-29 06:44:30,584 [root] DEBUG: 4104: DLL loaded at 0x00007FFF457F0000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-29 06:44:30,586 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4F740000: C:\Windows\System32\AppXDeploymentClient (0x102000 bytes).
2026-05-29 06:44:30,608 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994
2026-05-29 06:44:30,635 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994
2026-05-29 06:44:30,659 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994
2026-05-29 06:44:30,688 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FFF16AB0000, size 0x4b9994
2026-05-29 06:44:30,691 [root] DEBUG: 4104: DLL loaded at 0x00007FFF43550000: C:\Windows\SYSTEM32\NETAPI32 (0x19000 bytes).
2026-05-29 06:44:30,693 [root] DEBUG: 4104: DLL loaded at 0x00007FFF57010000: C:\Windows\SYSTEM32\ncrypt (0x27000 bytes).
2026-05-29 06:44:30,694 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56FD0000: C:\Windows\SYSTEM32\NTASN1 (0x3b000 bytes).
2026-05-29 06:44:30,694 [root] DEBUG: 4104: DLL loaded at 0x00007FFF50370000: C:\Windows\system32\PCPKsp (0x118000 bytes).
2026-05-29 06:44:30,695 [root] DEBUG: 4104: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:44:30,696 [root] DEBUG: 4104: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\tbs (0x1b000 bytes).
2026-05-29 06:44:30,697 [root] DEBUG: 4104: DLL loaded at 0x00007FFF45050000: C:\Windows\system32\ncryptprov (0x5a000 bytes).
2026-05-29 06:44:30,718 [root] DEBUG: 9656: caller_dispatch: Added region at 0x00007FFF16AB0000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FFF16CAF156, thread 9660).
2026-05-29 06:44:30,720 [root] DEBUG: 9656: caller_dispatch: Scanning calling region at 0x00007FFF16AB0000...
2026-05-29 06:44:30,731 [root] DEBUG: 9656: ProcessTrackedRegion: Region at 0x00007FFF16AB0000 mapped as \Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge_elf.dll appears unmodified, skipping
2026-05-29 06:44:30,733 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptprimitives (0x82000 bytes).
2026-05-29 06:44:30,772 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8
2026-05-29 06:44:30,788 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8
2026-05-29 06:44:30,803 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8
2026-05-29 06:44:30,819 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8
2026-05-29 06:44:30,838 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8
2026-05-29 06:44:30,853 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8
2026-05-29 06:44:30,871 [root] DEBUG: 9656: caller_dispatch: Added region at 0x00007FF6C7670000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF6C7764096, thread 9660).
2026-05-29 06:44:30,871 [root] DEBUG: 9656: YaraScan: Scanning 0x00007FF6C7670000, size 0x28b4d8
2026-05-29 06:44:30,875 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56D00000: C:\Windows\system32\mswsock (0x6a000 bytes).
2026-05-29 06:44:30,890 [root] DEBUG: 9656: ProcessImageBase: Main module image at 0x00007FF6C7670000 unmodified (entropy change 0.000000e+00)
2026-05-29 06:44:30,893 [root] DEBUG: 9656: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-29 06:44:30,923 [root] DEBUG: 9656: DLL loaded at 0x0000025931000000: C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge (0x136be000 bytes).
2026-05-29 06:44:30,926 [root] DEBUG: 9656: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-29 06:44:30,930 [root] DEBUG: 9656: DLL loaded at 0x00007FFF58380000: C:\Windows\System32\MSCTF (0x114000 bytes).
2026-05-29 06:44:30,970 [root] DEBUG: 9656: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-29 06:44:31,140 [root] DEBUG: 9656: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-29 06:44:31,146 [root] DEBUG: 9656: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-29 06:44:31,147 [root] DEBUG: 9656: DLL loaded at 0x00007FFF52860000: C:\Windows\System32\PROPSYS (0xf6000 bytes).
2026-05-29 06:44:31,148 [root] DEBUG: 9656: DLL loaded at 0x00007FFF54850000: C:\Windows\System32\CoreMessaging (0xf2000 bytes).
2026-05-29 06:44:31,148 [root] DEBUG: 9656: DLL loaded at 0x00007FFF46D30000: C:\Windows\System32\execmodelclient (0x63000 bytes).
2026-05-29 06:44:31,159 [root] DEBUG: 9656: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-29 06:44:31,162 [root] DEBUG: 9656: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-29 06:44:31,162 [root] DEBUG: 9656: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-29 06:44:31,163 [root] DEBUG: 9656: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-29 06:44:31,163 [root] DEBUG: 9656: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-29 06:44:31,172 [root] DEBUG: 9656: DLL loaded at 0x00007FFF48780000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-29 06:44:31,184 [root] DEBUG: 9656: DLL loaded at 0x00007FFF46AE0000: C:\Windows\system32\execmodelproxy (0x18000 bytes).
2026-05-29 06:44:31,196 [root] DEBUG: 9656: DLL loaded at 0x00007FFF566C0000: C:\Windows\System32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:44:31,197 [root] DEBUG: 9656: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:44:31,202 [root] DEBUG: 9656: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-29 06:44:31,216 [root] DEBUG: 9656: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-29 06:44:31,228 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4CBF0000: C:\Windows\System32\Windows.StateRepositoryPS (0x146000 bytes).
2026-05-29 06:44:31,243 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57AA0000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-29 06:44:31,244 [root] DEBUG: 9656: DLL loaded at 0x00007FFF501A0000: C:\Windows\SYSTEM32\capauthz (0x51000 bytes).
2026-05-29 06:44:31,247 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57130000: C:\Windows\System32\MSASN1 (0x12000 bytes).
2026-05-29 06:44:31,254 [root] DEBUG: 9656: DLL loaded at 0x00007FFF457F0000: C:\Windows\System32\Windows.ApplicationModel (0xe9000 bytes).
2026-05-29 06:44:31,271 [root] DEBUG: 9656: DLL loaded at 0x000002592FF50000: C:\Windows\System32\CryptoWinRT (0x61000 bytes).
2026-05-29 06:44:31,282 [lib.api.process] INFO: Monitor config for process 832: C:\lpw_albt\dll\832.ini
2026-05-29 06:44:31,283 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:31,285 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:31,292 [root] DEBUG: Loader: Injecting process 832 with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:31,297 [root] DEBUG: 832: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:44:31,297 [root] DEBUG: 832: Disabling sleep skipping.
2026-05-29 06:44:31,298 [root] DEBUG: 832: Interactive desktop enabled.
2026-05-29 06:44:31,298 [root] DEBUG: 832: Dropped file limit defaulting to 100.
2026-05-29 06:44:31,300 [root] DEBUG: 832: Services hook set enabled
2026-05-29 06:44:31,302 [root] DEBUG: 832: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:44:31,313 [root] DEBUG: 832: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:44:31,314 [root] DEBUG: 832: Monitor initialised: 64-bit capemon loaded in process 832 at 0x00007FFF18240000, thread 10180, image base 0x00007FF7BF220000, stack from 0x000000CCA7AF4000-0x000000CCA7B00000
2026-05-29 06:44:31,316 [root] DEBUG: 832: Commandline: C:\Windows\system32\svchost.exe -k DcomLaunch -p
2026-05-29 06:44:31,331 [root] DEBUG: 832: Hooked 69 out of 69 functions
2026-05-29 06:44:31,332 [root] INFO: Loaded monitor into process with pid 832
2026-05-29 06:44:31,333 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-29 06:44:31,333 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:31,335 [lib.api.process] INFO: Injected into 64-bit <Process 832 svchost.exe>
2026-05-29 06:44:33,355 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4B780000: C:\Windows\System32\StateRepository.Core (0xb1000 bytes).
2026-05-29 06:44:33,356 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4B840000: C:\Windows\System32\Windows.StateRepository (0x58e000 bytes).
2026-05-29 06:44:33,358 [root] DEBUG: 9656: DLL loaded at 0x00007FFF43150000: C:\Windows\System32\TileDataRepository (0x99000 bytes).
2026-05-29 06:44:33,359 [root] DEBUG: 9656: DLL loaded at 0x00007FFF3D7B0000: C:\Windows\System32\biwinrt (0x53000 bytes).
2026-05-29 06:44:33,368 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4F6E0000: C:\Windows\System32\usermgrproxy (0x54000 bytes).
2026-05-29 06:44:33,396 [root] DEBUG: 9656: DLL loaded at 0x00007FFF55EF0000: C:\Windows\System32\dxgi (0xf3000 bytes).
2026-05-29 06:44:33,397 [root] DEBUG: 9656: DLL loaded at 0x00007FFF53070000: C:\Windows\System32\d3d11 (0x263000 bytes).
2026-05-29 06:44:33,404 [root] DEBUG: 9656: DLL loaded at 0x00007FFF48B40000: C:\Windows\System32\WININET (0x4d6000 bytes).
2026-05-29 06:44:33,405 [root] DEBUG: 9656: DLL loaded at 0x00007FFF3D6A0000: C:\Windows\System32\windows.internal.shell.broker (0xdd000 bytes).
2026-05-29 06:44:33,425 [root] DEBUG: 9656: DLL loaded at 0x00007FFF43060000: C:\Windows\System32\PCShellCommonProxyStub (0x13000 bytes).
2026-05-29 06:44:33,455 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57520000: C:\Windows\System32\USERENV (0x2e000 bytes).
2026-05-29 06:44:33,456 [root] DEBUG: 9656: DLL loaded at 0x00007FFF56FA0000: C:\Windows\System32\Wldp (0x2d000 bytes).
2026-05-29 06:44:33,457 [root] DEBUG: 9656: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-29 06:44:33,458 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4C520000: C:\Windows\System32\Bcp47Langs (0x5b000 bytes).
2026-05-29 06:44:33,458 [root] DEBUG: 9656: DLL loaded at 0x00007FFF43DD0000: C:\Windows\System32\StartTileData (0x58a000 bytes).
2026-05-29 06:44:33,489 [root] DEBUG: 9656: DLL loaded at 0x00007FFF3D810000: C:\Windows\System32\Windows.Storage.ApplicationData (0x66000 bytes).
2026-05-29 06:44:33,579 [root] DEBUG: 9656: DLL loaded at 0x00007FFF4CD40000: C:\Windows\system32\mssprxy (0x28000 bytes).
2026-05-29 06:44:33,622 [root] DEBUG: 9656: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\CFGMGR32 (0x4e000 bytes).
2026-05-29 06:44:40,168 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 9452: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000
2026-05-29 06:44:40,170 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9452
2026-05-29 06:44:40,170 [lib.api.process] INFO: Monitor config for process 9452: C:\lpw_albt\dll\9452.ini
2026-05-29 06:44:40,171 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,172 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,177 [root] DEBUG: Loader: Injecting process 9452 (thread 9428) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,178 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:40,179 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,180 [lib.api.process] INFO: Injected into 64-bit <Process 9452 backgroundTaskHost.exe>
2026-05-29 06:44:40,182 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9452
2026-05-29 06:44:40,182 [lib.api.process] INFO: Monitor config for process 9452: C:\lpw_albt\dll\9452.ini
2026-05-29 06:44:40,182 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,183 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,188 [root] DEBUG: Loader: Injecting process 9452 (thread 9428) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,188 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:44:40,189 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,190 [lib.api.process] INFO: Injected into 64-bit <Process 9452 backgroundTaskHost.exe>
2026-05-29 06:44:40,192 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9452
2026-05-29 06:44:40,192 [lib.api.process] INFO: Monitor config for process 9452: C:\lpw_albt\dll\9452.ini
2026-05-29 06:44:40,200 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,201 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,214 [root] DEBUG: Loader: Injecting process 9452 with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,215 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 9428, handle 0x120
2026-05-29 06:44:40,216 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:44:40,217 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,219 [lib.api.process] INFO: Injected into 64-bit <Process 9452 backgroundTaskHost.exe>
2026-05-29 06:44:40,228 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 10160: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000
2026-05-29 06:44:40,228 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 10160
2026-05-29 06:44:40,229 [lib.api.process] INFO: Monitor config for process 10160: C:\lpw_albt\dll\10160.ini
2026-05-29 06:44:40,229 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,230 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,235 [root] DEBUG: Loader: Injecting process 10160 (thread 10156) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,235 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:40,237 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,247 [lib.api.process] INFO: Injected into 64-bit <Process 10160 backgroundTaskHost.exe>
2026-05-29 06:44:40,250 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 10160
2026-05-29 06:44:40,251 [lib.api.process] INFO: Monitor config for process 10160: C:\lpw_albt\dll\10160.ini
2026-05-29 06:44:40,251 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,252 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,261 [root] DEBUG: Loader: Injecting process 10160 (thread 10156) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,262 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:44:40,263 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,268 [lib.api.process] INFO: Injected into 64-bit <Process 10160 backgroundTaskHost.exe>
2026-05-29 06:44:40,273 [root] INFO: Process with pid 10160 has terminated
2026-05-29 06:44:40,279 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 8272: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000
2026-05-29 06:44:40,280 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8272
2026-05-29 06:44:40,280 [lib.api.process] INFO: Monitor config for process 8272: C:\lpw_albt\dll\8272.ini
2026-05-29 06:44:40,281 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,282 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,289 [root] DEBUG: Loader: Injecting process 8272 (thread 1152) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,289 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:40,290 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,292 [lib.api.process] INFO: Injected into 64-bit <Process 8272 backgroundTaskHost.exe>
2026-05-29 06:44:40,293 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 8272
2026-05-29 06:44:40,293 [lib.api.process] INFO: Monitor config for process 8272: C:\lpw_albt\dll\8272.ini
2026-05-29 06:44:40,293 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,294 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,298 [root] DEBUG: Loader: Injecting process 8272 (thread 1152) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,299 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:44:40,301 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,302 [lib.api.process] INFO: Injected into 64-bit <Process 8272 backgroundTaskHost.exe>
2026-05-29 06:44:40,303 [root] INFO: Process with pid 8272 has terminated
2026-05-29 06:44:40,307 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 9120: C:\Windows\system32\backgroundTaskHost.exe, ImageBase: 0x00007FF62C670000
2026-05-29 06:44:40,308 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9120
2026-05-29 06:44:40,308 [lib.api.process] INFO: Monitor config for process 9120: C:\lpw_albt\dll\9120.ini
2026-05-29 06:44:40,309 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,310 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,316 [root] DEBUG: Loader: Injecting process 9120 (thread 1880) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,317 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:40,317 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,319 [lib.api.process] INFO: Injected into 64-bit <Process 9120 backgroundTaskHost.exe>
2026-05-29 06:44:40,320 [root] INFO: Announced 64-bit process name: backgroundTaskHost.exe pid: 9120
2026-05-29 06:44:40,320 [lib.api.process] INFO: Monitor config for process 9120: C:\lpw_albt\dll\9120.ini
2026-05-29 06:44:40,321 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:40,322 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:40,326 [root] DEBUG: Loader: Injecting process 9120 (thread 1880) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,326 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:44:40,328 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:40,330 [lib.api.process] INFO: Injected into 64-bit <Process 9120 backgroundTaskHost.exe>
2026-05-29 06:44:40,332 [root] INFO: Process with pid 9120 has terminated
2026-05-29 06:44:43,727 [root] INFO: Process with pid 9656 has terminated
2026-05-29 06:44:43,728 [root] DEBUG: 9656: NtTerminateProcess hook: Attempting to dump process 9656
2026-05-29 06:44:43,730 [root] DEBUG: 9656: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:44:46,682 [root] INFO: Announced starting service "b'edgeupdate'"
2026-05-29 06:44:46,682 [lib.api.process] INFO: Monitor config for process 676: C:\lpw_albt\dll\676.ini
2026-05-29 06:44:46,683 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:46,684 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:44:46,688 [root] DEBUG: Loader: Injecting process 676 with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:46,689 [root] DEBUG: Loader: Copied config file C:\lpw_albt\dll\676.ini to system path C:\676.ini
2026-05-29 06:44:46,692 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 676 C:\lpw_albt\dll\yCvZHFYF.dll
2026-05-29 06:44:46,692 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:44:46,693 [lib.api.process] INFO: Injected into 64-bit <Process 676 services.exe>
2026-05-29 06:44:47,916 [root] DEBUG: 676: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:44:47,924 [root] DEBUG: 676: Disabling sleep skipping.
2026-05-29 06:44:47,925 [root] DEBUG: 676: Interactive desktop enabled.
2026-05-29 06:44:47,926 [root] DEBUG: 676: Dropped file limit defaulting to 100.
2026-05-29 06:44:47,929 [root] DEBUG: 676: Services hook set enabled
2026-05-29 06:44:47,945 [root] DEBUG: 676: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:44:47,945 [root] DEBUG: 676: Monitor initialised: 64-bit capemon loaded in process 676 at 0x00007FFEFAB30000, thread 6500, image base 0x00007FF7839A0000, stack from 0x000000F2F01F2000-0x000000F2F0200000
2026-05-29 06:44:47,945 [root] DEBUG: 676: Commandline: C:\Windows\system32\services.exe
2026-05-29 06:44:47,960 [root] DEBUG: 676: Hooked 69 out of 69 functions
2026-05-29 06:44:47,963 [root] INFO: Loaded monitor into process with pid 676
2026-05-29 06:44:49,812 [root] DEBUG: 676: DLL loaded at 0x00007FFF56FA0000: C:\Windows\system32\Wldp (0x2d000 bytes).
2026-05-29 06:44:49,819 [root] DEBUG: 676: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-29 06:44:49,831 [root] DEBUG: 676: DLL loaded at 0x00007FFF58070000: C:\Windows\system32\SHCORE (0xad000 bytes).
2026-05-29 06:44:49,848 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 5932: C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe, ImageBase: 0x0000000000150000
2026-05-29 06:44:49,864 [root] INFO: Announced 32-bit process name: MicrosoftEdgeUpdate.exe pid: 5932
2026-05-29 06:44:49,872 [lib.api.process] INFO: Monitor config for process 5932: C:\lpw_albt\dll\5932.ini
2026-05-29 06:44:49,873 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:49,906 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\nxatNo.dll, loader C:\lpw_albt\bin\pNxCcCJ.exe
2026-05-29 06:44:49,990 [root] DEBUG: Loader: Injecting process 5932 (thread 5888) with C:\lpw_albt\dll\nxatNo.dll.
2026-05-29 06:44:49,992 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:49,992 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\nxatNo.dll.
2026-05-29 06:44:49,996 [lib.api.process] INFO: Injected into 32-bit <Process 5932 MicrosoftEdgeUpdate.exe>
2026-05-29 06:44:49,998 [root] INFO: Announced 32-bit process name: MicrosoftEdgeUpdate.exe pid: 5932
2026-05-29 06:44:49,998 [lib.api.process] INFO: Monitor config for process 5932: C:\lpw_albt\dll\5932.ini
2026-05-29 06:44:49,999 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:50,000 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\nxatNo.dll, loader C:\lpw_albt\bin\pNxCcCJ.exe
2026-05-29 06:44:50,006 [root] DEBUG: Loader: Injecting process 5932 (thread 5888) with C:\lpw_albt\dll\nxatNo.dll.
2026-05-29 06:44:50,007 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:44:50,007 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\nxatNo.dll.
2026-05-29 06:44:50,009 [lib.api.process] INFO: Injected into 32-bit <Process 5932 MicrosoftEdgeUpdate.exe>
2026-05-29 06:44:50,009 [root] INFO: Announced 32-bit process name: MicrosoftEdgeUpdate.exe pid: 5932
2026-05-29 06:44:50,010 [lib.api.process] INFO: Monitor config for process 5932: C:\lpw_albt\dll\5932.ini
2026-05-29 06:44:50,010 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:50,011 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\nxatNo.dll, loader C:\lpw_albt\bin\pNxCcCJ.exe
2026-05-29 06:44:50,016 [root] DEBUG: Loader: Injecting process 5932 with C:\lpw_albt\dll\nxatNo.dll.
2026-05-29 06:44:50,017 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2026-05-29 06:44:50,074 [root] DEBUG: 5932: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:44:50,075 [root] DEBUG: 5932: Interactive desktop enabled.
2026-05-29 06:44:50,076 [root] DEBUG: 5932: Dropped file limit defaulting to 100.
2026-05-29 06:44:50,080 [root] DEBUG: 5932: Disabling sleep skipping.
2026-05-29 06:44:50,091 [root] DEBUG: 5932: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:44:50,091 [root] DEBUG: 5932: YaraScan: Scanning 0x00150000, size 0x34220
2026-05-29 06:44:50,093 [root] DEBUG: 5932: Monitor initialised: 32-bit capemon loaded in process 5932 at 0x6ab90000, thread 9680, image base 0x150000, stack from 0x2734000-0x2740000
2026-05-29 06:44:50,094 [root] DEBUG: 5932: Commandline: "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
2026-05-29 06:44:50,128 [root] DEBUG: 5932: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-29 06:44:50,153 [root] DEBUG: 5932: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-29 06:44:50,153 [root] DEBUG: 5932: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-29 06:44:50,159 [root] DEBUG: 5932: Hooked 632 out of 632 functions
2026-05-29 06:44:50,162 [root] DEBUG: 5932: Syscall hook installed, syscall logging level 1
2026-05-29 06:44:50,170 [root] DEBUG: 5932: RestoreHeaders: Restored original import table.
2026-05-29 06:44:50,172 [root] INFO: Loaded monitor into process with pid 5932
2026-05-29 06:44:50,172 [root] DEBUG: 5932: caller_dispatch: Added region at 0x023D0000 to tracked regions list (ntdll::LdrLoadDll returns to 0x023D0035, thread 9680).
2026-05-29 06:44:50,173 [root] DEBUG: 5932: DumpPEsInRange: Scanning range 0x023D0000 - 0x023D0127.
2026-05-29 06:44:50,173 [root] DEBUG: 5932: ScanForDisguisedPE: Size too small: 0x127 bytes
2026-05-29 06:44:50,186 [lib.common.results] INFO: Uploading file C:\gZRInK\CAPE\5932_284721350441029552026 to CAPE\760e3c46aa0d294ae0c9528bdd5ad0e57b0e0a20301b2e3a7ca6bd400b7ee76a; Size is 295; Max size: 100000000
2026-05-29 06:44:50,194 [root] DEBUG: 5932: DumpMemory: Payload successfully created: C:\gZRInK\CAPE\5932_284721350441029552026 (size 295 bytes)
2026-05-29 06:44:50,194 [root] DEBUG: 5932: DumpRegion: Dumped entire allocation from 0x023D0000, size 4096 bytes.
2026-05-29 06:44:50,195 [root] DEBUG: 5932: ProcessTrackedRegion: Dumped region at 0x023D0000.
2026-05-29 06:44:50,195 [root] DEBUG: 5932: YaraScan: Scanning 0x023D0000, size 0x127
2026-05-29 06:44:50,196 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2026-05-29 06:44:50,197 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\nxatNo.dll.
2026-05-29 06:44:50,199 [lib.api.process] INFO: Injected into 32-bit <Process 5932 MicrosoftEdgeUpdate.exe>
2026-05-29 06:44:50,200 [root] DEBUG: 5932: caller_dispatch: Added region at 0x00150000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x0015D98E, thread 5888).
2026-05-29 06:44:50,200 [root] DEBUG: 5932: YaraScan: Scanning 0x00150000, size 0x34220
2026-05-29 06:44:50,203 [root] DEBUG: 5932: ProcessImageBase: Main module image at 0x00150000 unmodified (entropy change 0.000000e+00)
2026-05-29 06:44:50,210 [root] DEBUG: 5932: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-29 06:44:50,210 [root] DEBUG: 5932: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-29 06:44:50,220 [root] DEBUG: 5932: DLL loaded at 0x75F00000: C:\Windows\System32\SHCORE (0x87000 bytes).
2026-05-29 06:44:50,233 [root] DEBUG: 5932: DLL loaded at 0x70670000: C:\Windows\SYSTEM32\NETAPI32 (0x14000 bytes).
2026-05-29 06:44:50,234 [root] DEBUG: 5932: DLL loaded at 0x75460000: C:\Windows\SYSTEM32\VERSION (0x8000 bytes).
2026-05-29 06:44:50,235 [root] DEBUG: 5932: DLL loaded at 0x75450000: C:\Windows\SYSTEM32\WTSAPI32 (0xf000 bytes).
2026-05-29 06:44:50,235 [root] DEBUG: 5932: DLL loaded at 0x74890000: C:\Windows\SYSTEM32\NETUTILS (0xb000 bytes).
2026-05-29 06:44:50,236 [root] DEBUG: 5932: DLL loaded at 0x748A0000: C:\Windows\SYSTEM32\WKSCLI (0x11000 bytes).
2026-05-29 06:44:50,237 [root] DEBUG: 5932: DLL loaded at 0x6AEB0000: C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.233.3\msedgeupdate (0x23d000 bytes).
2026-05-29 06:44:50,252 [root] DEBUG: 5932: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-29 06:44:50,253 [root] DEBUG: 5932: DLL loaded at 0x755E0000: C:\Windows\system32\MDMRegistration (0x53000 bytes).
2026-05-29 06:44:50,269 [root] DEBUG: 5932: DLL loaded at 0x6F2A0000: C:\Windows\SYSTEM32\powrprof (0x44000 bytes).
2026-05-29 06:44:50,270 [root] DEBUG: 5932: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2026-05-29 06:44:50,271 [root] DEBUG: 5932: DLL loaded at 0x70D00000: C:\Windows\SYSTEM32\ncrypt (0x21000 bytes).
2026-05-29 06:44:50,271 [root] DEBUG: 5932: DLL loaded at 0x76790000: C:\Windows\System32\imagehlp (0x19000 bytes).
2026-05-29 06:44:50,271 [root] DEBUG: 5932: DLL loaded at 0x75520000: C:\Windows\SYSTEM32\tbs (0x13000 bytes).
2026-05-29 06:44:50,272 [root] DEBUG: 5932: DLL loaded at 0x75540000: C:\Windows\SYSTEM32\DMCmnUtils (0x63000 bytes).
2026-05-29 06:44:50,272 [root] DEBUG: 5932: DLL loaded at 0x755B0000: C:\Windows\SYSTEM32\omadmapi (0x2c000 bytes).
2026-05-29 06:44:50,274 [root] DEBUG: 5932: DLL loaded at 0x6F290000: C:\Windows\SYSTEM32\UMPDC (0xd000 bytes).
2026-05-29 06:44:50,276 [root] DEBUG: 5932: DLL loaded at 0x70200000: C:\Windows\SYSTEM32\NTASN1 (0x28000 bytes).
2026-05-29 06:44:50,283 [root] DEBUG: 5932: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-29 06:44:50,284 [root] DEBUG: 5932: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\cryptsp (0x13000 bytes).
2026-05-29 06:44:50,287 [root] DEBUG: 5932: DLL loaded at 0x6EC40000: C:\Windows\SYSTEM32\DSREG (0x107000 bytes).
2026-05-29 06:44:50,302 [root] DEBUG: 5932: DLL loaded at 0x74180000: C:\Windows\SYSTEM32\profapi (0x1c000 bytes).
2026-05-29 06:44:50,339 [root] DEBUG: 5932: api-rate-cap: NtWaitForSingleObject hook disabled due to rate
2026-05-29 06:44:50,346 [root] DEBUG: 5932: DLL loaded at 0x74950000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-29 06:44:50,358 [root] DEBUG: 5932: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-05-29 06:44:50,365 [root] DEBUG: 5932: DLL loaded at 0x76650000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-05-29 06:44:50,382 [root] DEBUG: 5932: DLL loaded at 0x755E0000: C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.233.3\psmachine (0x58000 bytes).
2026-05-29 06:44:50,681 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2026-05-29 06:44:50,682 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6408, handle 0x3c4: Error obtaining target process name
2026-05-29 06:44:50,871 [root] DEBUG: 5932: DLL loaded at 0x75580000: C:\Windows\System32\SystemSettings.DataModel (0x57000 bytes).
2026-05-29 06:44:50,873 [root] DEBUG: 5932: caller_dispatch: Added region at 0x75580000 to tracked regions list (ntdll::LdrGetDllHandle returns to 0x755AB711, thread 10280).
2026-05-29 06:44:50,874 [root] DEBUG: 5932: ProcessTrackedRegion: Region at 0x75580000 mapped as \Device\HarddiskVolume2\Windows\SysWOW64\SystemSettings.DataModel.dll is in known range, skipping
2026-05-29 06:44:50,882 [root] DEBUG: 5932: DLL loaded at 0x75410000: C:\Windows\SYSTEM32\USERENV (0x25000 bytes).
2026-05-29 06:44:50,895 [root] DEBUG: 5932: CreateThreadBreakpoints: Failed to open thread and get a handle.
2026-05-29 06:44:50,896 [root] DEBUG: 5932: CreateThreadBreakpoints: Failed to open thread and get a handle.
2026-05-29 06:44:50,906 [root] DEBUG: 5932: DLL loaded at 0x6FCF0000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x3ba000 bytes).
2026-05-29 06:44:50,941 [root] DEBUG: 5932: DLL loaded at 0x77270000: C:\Windows\System32\CFGMGR32 (0x3b000 bytes).
2026-05-29 06:44:50,951 [root] DEBUG: 5932: DLL loaded at 0x754F0000: C:\Windows\System32\StructuredQuery (0x81000 bytes).
2026-05-29 06:44:50,967 [root] DEBUG: 5932: DLL loaded at 0x70910000: C:\Windows\SYSTEM32\PROPSYS (0xc2000 bytes).
2026-05-29 06:44:50,980 [root] DEBUG: 5932: DLL loaded at 0x6AAF0000: C:\Windows\System32\Windows.StateRepositoryPS (0x93000 bytes).
2026-05-29 06:44:51,018 [root] DEBUG: 5932: DLL loaded at 0x6AA50000: C:\Windows\system32\Windows.Storage.Search (0x9d000 bytes).
2026-05-29 06:44:51,060 [root] DEBUG: 5932: DLL loaded at 0x754E0000: C:\Windows\SYSTEM32\LINKINFO (0xb000 bytes).
2026-05-29 06:44:51,123 [root] DEBUG: 5932: DLL loaded at 0x6F0B0000: C:\Windows\System32\msxml6 (0x1dd000 bytes).
2026-05-29 06:44:51,136 [root] DEBUG: 5932: DLL loaded at 0x6AE60000: C:\Windows\SYSTEM32\WINSTA (0x47000 bytes).
2026-05-29 06:44:51,156 [root] DEBUG: 5932: DLL loaded at 0x75340000: C:\Windows\system32\winhttp (0xca000 bytes).
2026-05-29 06:44:51,161 [root] DEBUG: 5932: DLL loaded at 0x6E3B0000: C:\Windows\system32\OnDemandConnRouteHelper (0x12000 bytes).
2026-05-29 06:44:51,165 [root] DEBUG: 5932: DLL loaded at 0x73FA0000: C:\Windows\SYSTEM32\IPHLPAPI (0x32000 bytes).
2026-05-29 06:44:51,166 [root] DEBUG: 5932: DLL loaded at 0x76290000: C:\Windows\System32\NSI (0x7000 bytes).
2026-05-29 06:44:51,170 [root] DEBUG: 5932: DLL loaded at 0x6BC10000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x14000 bytes).
2026-05-29 06:44:51,173 [root] DEBUG: 5932: DLL loaded at 0x73F80000: C:\Windows\SYSTEM32\dhcpcsvc (0x16000 bytes).
2026-05-29 06:44:51,185 [root] DEBUG: 5932: DLL loaded at 0x6A9D0000: C:\Windows\SYSTEM32\webio (0x73000 bytes).
2026-05-29 06:44:51,190 [root] DEBUG: 5932: DLL loaded at 0x6E350000: C:\Windows\system32\mswsock (0x52000 bytes).
2026-05-29 06:44:51,200 [root] DEBUG: 5932: DLL loaded at 0x6E2F0000: C:\Windows\SYSTEM32\WINNSI (0x8000 bytes).
2026-05-29 06:44:51,207 [root] DEBUG: 5932: DLL loaded at 0x702C0000: C:\Windows\SYSTEM32\DNSAPI (0x90000 bytes).
2026-05-29 06:44:51,212 [root] DEBUG: 5932: DLL loaded at 0x6D030000: C:\Windows\System32\rasadhlp (0x8000 bytes).
2026-05-29 06:44:51,256 [root] DEBUG: 5932: DLL loaded at 0x6CFD0000: C:\Windows\System32\fwpuclnt (0x58000 bytes).
2026-05-29 06:44:51,629 [root] DEBUG: 5932: DLL loaded at 0x6CF50000: C:\Windows\System32\schannel (0x7c000 bytes).
2026-05-29 06:44:52,290 [root] DEBUG: 4104: DLL loaded at 0x00007FFF18180000: C:\Windows\System32\Windows.System.UserProfile.DiagnosticsSettings (0x15000 bytes).
2026-05-29 06:44:52,291 [root] DEBUG: 5932: DLL loaded at 0x6CF40000: C:\Windows\SYSTEM32\mskeyprotect (0x10000 bytes).
2026-05-29 06:44:52,292 [root] DEBUG: 5932: DLL loaded at 0x70200000: C:\Windows\SYSTEM32\NTASN1 (0x28000 bytes).
2026-05-29 06:44:52,293 [root] DEBUG: 5932: DLL loaded at 0x70D00000: C:\Windows\SYSTEM32\ncrypt (0x21000 bytes).
2026-05-29 06:44:52,295 [root] DEBUG: 5932: DLL loaded at 0x6CEF0000: C:\Windows\system32\ncryptsslp (0x1f000 bytes).
2026-05-29 06:44:52,297 [root] DEBUG: 5932: DLL loaded at 0x701B0000: C:\Windows\SYSTEM32\MSASN1 (0xe000 bytes).
2026-05-29 06:44:52,386 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 10500: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:52,387 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 10500
2026-05-29 06:44:52,388 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 10500
2026-05-29 06:44:52,645 [root] DEBUG: Error 87 (0x57) - OpenProcessHandler: Error obtaining target process name: The parameter is incorrect.
2026-05-29 06:44:52,647 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4, handle 0x73c: Error obtaining target process name
2026-05-29 06:44:52,647 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 124, handle 0x73c:
2026-05-29 06:44:52,648 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 384, handle 0x73c: C:\Windows\System32\smss.exe
2026-05-29 06:44:52,648 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 480, handle 0x73c: C:\Windows\System32\csrss.exe
2026-05-29 06:44:52,648 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 556, handle 0x73c: C:\Windows\System32\wininit.exe
2026-05-29 06:44:52,649 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 576, handle 0x73c: C:\Windows\System32\csrss.exe
2026-05-29 06:44:52,650 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 656, handle 0x73c: C:\Windows\System32\winlogon.exe
2026-05-29 06:44:52,650 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 676, handle 0x73c: C:\Windows\System32\services.exe
2026-05-29 06:44:52,650 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 724, handle 0x73c: C:\Windows\System32\lsass.exe
2026-05-29 06:44:52,651 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 832, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,651 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 860, handle 0x73c: C:\Windows\System32\fontdrvhost.exe
2026-05-29 06:44:52,652 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 868, handle 0x73c: C:\Windows\System32\fontdrvhost.exe
2026-05-29 06:44:52,652 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 948, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,653 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1004, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,653 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 472, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,654 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 772, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,654 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1048, handle 0x73c: C:\Windows\System32\dwm.exe
2026-05-29 06:44:52,655 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1096, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,655 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1136, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,656 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1164, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,656 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1268, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,657 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1284, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,657 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1292, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,658 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1308, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,658 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1352, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,658 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1444, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,659 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1596, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,661 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1632, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,661 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1644, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,662 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1664, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,662 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1828, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,663 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1852, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,663 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1860, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,664 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1868, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,664 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1992, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,665 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2020, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,665 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2036, handle 0x73c:
2026-05-29 06:44:52,666 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2124, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,666 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2224, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,666 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2240, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,667 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2296, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,667 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2344, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,668 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2456, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,668 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2472, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,669 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2520, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,669 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2696, handle 0x73c: C:\Windows\System32\spoolsv.exe
2026-05-29 06:44:52,669 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2724, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,670 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2772, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,670 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2876, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,671 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2896, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,671 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3012, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,672 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3020, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,672 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3040, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,673 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3048, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,673 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3056, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,674 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2292, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,674 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2820, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,675 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3396, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,676 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3892, handle 0x73c: C:\Windows\System32\SearchIndexer.exe
2026-05-29 06:44:52,677 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3992, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,677 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3500, handle 0x73c: C:\Windows\System32\sihost.exe
2026-05-29 06:44:52,678 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3416, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,678 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4148, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,679 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4240, handle 0x73c: C:\Windows\System32\taskhostw.exe
2026-05-29 06:44:52,679 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4300, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,680 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4380, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,680 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4484, handle 0x73c: C:\Windows\explorer.exe
2026-05-29 06:44:52,681 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4524, handle 0x73c: C:\Windows\System32\ctfmon.exe
2026-05-29 06:44:52,681 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4592, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,681 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4788, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,682 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4916, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,682 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5200, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,683 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5260, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,683 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5544, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,683 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5624, handle 0x73c: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
2026-05-29 06:44:52,684 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5688, handle 0x73c: C:\Windows\System32\RuntimeBroker.exe
2026-05-29 06:44:52,684 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5800, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,685 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5892, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,685 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6008, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,686 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6136, handle 0x73c: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
2026-05-29 06:44:52,686 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5948, handle 0x73c: C:\Windows\System32\RuntimeBroker.exe
2026-05-29 06:44:52,687 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6436, handle 0x73c: C:\Windows\System32\RuntimeBroker.exe
2026-05-29 06:44:52,687 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6616, handle 0x73c: C:\Windows\System32\taskhostw.exe
2026-05-29 06:44:52,687 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6996, handle 0x73c: C:\Windows\System32\smartscreen.exe
2026-05-29 06:44:52,688 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7052, handle 0x73c: C:\Windows\System32\SecurityHealthSystray.exe
2026-05-29 06:44:52,688 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7088, handle 0x73c: C:\Windows\System32\SecurityHealthService.exe
2026-05-29 06:44:52,689 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6284, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,689 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3976, handle 0x73c: C:\Windows\System32\conhost.exe
2026-05-29 06:44:52,690 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1104, handle 0x73c: C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
2026-05-29 06:44:52,690 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5128, handle 0x73c: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-29 06:44:52,691 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6768, handle 0x73c: C:\Program Files (x86)\Steam\steam.exe
2026-05-29 06:44:52,692 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6400, handle 0x73c: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-29 06:44:52,693 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6356, handle 0x73c: C:\Program Files (x86)\Common Files\Steam\steamservice.exe
2026-05-29 06:44:52,693 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6360, handle 0x73c: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-29 06:44:52,694 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6392, handle 0x73c: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-29 06:44:52,694 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2160, handle 0x73c: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-29 06:44:52,694 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6512, handle 0x73c: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-29 06:44:52,695 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6504, handle 0x73c: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-29 06:44:52,695 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7444, handle 0x73c: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-29 06:44:52,696 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7544, handle 0x73c: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-29 06:44:52,696 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7844, handle 0x73c: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-29 06:44:52,697 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8100, handle 0x73c: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-29 06:44:52,697 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8340, handle 0x73c: C:\Users\admin\AppData\Local\Discord\app-1.0.9238\Discord.exe
2026-05-29 06:44:52,698 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8108, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,698 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3820, handle 0x73c: C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
2026-05-29 06:44:52,699 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8044, handle 0x73c: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
2026-05-29 06:44:52,699 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1740, handle 0x73c: C:\Windows\System32\dllhost.exe
2026-05-29 06:44:52,700 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1316, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,700 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 3404, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,701 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5364, handle 0x73c: C:\Windows\System32\SgrmBroker.exe
2026-05-29 06:44:52,701 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6640, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,702 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2580, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,702 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6028, handle 0x73c: C:\Windows\System32\MoUsoCoreWorker.exe
2026-05-29 06:44:52,702 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6188, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,703 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5116, handle 0x73c: C:\Windows\System32\backgroundTaskHost.exe
2026-05-29 06:44:52,703 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8828, handle 0x73c: C:\Windows\System32\CompatTelRunner.exe
2026-05-29 06:44:52,704 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6280, handle 0x73c: C:\Windows\servicing\TrustedInstaller.exe
2026-05-29 06:44:52,704 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1028, handle 0x73c: C:\Windows\System32\notepad.exe
2026-05-29 06:44:52,705 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4932, handle 0x73c: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3745_none_7ded3f327ca60a41\TiWorker.exe
2026-05-29 06:44:52,706 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1016, handle 0x73c: C:\Windows\System32\RuntimeBroker.exe
2026-05-29 06:44:52,708 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2016, handle 0x73c: C:\Windows\System32\conhost.exe
2026-05-29 06:44:52,709 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2672, handle 0x73c: C:\Windows\System32\RuntimeBroker.exe
2026-05-29 06:44:52,709 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 6568, handle 0x73c: C:\Windows\System32\CompatTelRunner.exe
2026-05-29 06:44:52,710 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5040, handle 0x73c: C:\Windows\System32\sppsvc.exe
2026-05-29 06:44:52,710 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2916, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,711 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8700, handle 0x73c: C:\Windows\System32\wbem\WmiPrvSE.exe
2026-05-29 06:44:52,712 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4104, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,712 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1204, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,713 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2168, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,713 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 1332, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,714 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4760, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,714 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 4108, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,715 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 5820, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,715 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8604, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,716 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 8504, handle 0x73c: C:\Windows\System32\wbem\WmiPrvSE.exe
2026-05-29 06:44:52,716 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 7080, handle 0x73c: C:\Windows\System32\wbem\WmiPrvSE.exe
2026-05-29 06:44:52,716 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 9328, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,717 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 9344, handle 0x73c: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
2026-05-29 06:44:52,717 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 9568, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,718 [root] DEBUG: 5932: OpenProcessHandler: Injection info created for process 2464, handle 0x73c: C:\Windows\System32\svchost.exe
2026-05-29 06:44:52,732 [root] DEBUG: 5932: DLL loaded at 0x6E2E0000: C:\Windows\SYSTEM32\DPAPI (0x8000 bytes).
2026-05-29 06:44:52,733 [root] DEBUG: 5932: CreateProcessHandler: Injection info set for new process 11132: C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe, ImageBase: 0x00150000
2026-05-29 06:44:52,734 [root] INFO: Announced 32-bit process name: MicrosoftEdgeUpdate.exe pid: 11132
2026-05-29 06:44:52,734 [lib.api.process] INFO: Monitor config for process 11132: C:\lpw_albt\dll\11132.ini
2026-05-29 06:44:52,735 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:44:52,736 [lib.api.process] INFO: 32-bit DLL to inject is C:\lpw_albt\dll\nxatNo.dll, loader C:\lpw_albt\bin\pNxCcCJ.exe
2026-05-29 06:44:52,743 [root] DEBUG: Loader: Injecting process 11132 (thread 11136) with C:\lpw_albt\dll\nxatNo.dll.
2026-05-29 06:44:52,744 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:44:52,744 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\nxatNo.dll.
2026-05-29 06:44:52,745 [lib.api.process] INFO: Injected into 32-bit <Process 11132 MicrosoftEdgeUpdate.exe>
2026-05-29 06:44:52,747 [root] DEBUG: 5932: DLL loaded at 0x74960000: C:\Windows\system32\apphelp (0x9f000 bytes).
2026-05-29 06:44:52,754 [root] DEBUG: 11132: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:44:52,755 [root] DEBUG: 11132: Interactive desktop enabled.
2026-05-29 06:44:52,755 [root] DEBUG: 11132: Dropped file limit defaulting to 100.
2026-05-29 06:44:52,757 [root] DEBUG: 11132: Disabling sleep skipping.
2026-05-29 06:44:52,759 [root] DEBUG: 11132: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:44:52,760 [root] DEBUG: 11132: YaraScan: Scanning 0x00150000, size 0x34220
2026-05-29 06:44:52,761 [root] DEBUG: 11132: Monitor initialised: 32-bit capemon loaded in process 11132 at 0x6ab90000, thread 11136, image base 0x150000, stack from 0x2cf5000-0x2d00000
2026-05-29 06:44:52,762 [root] DEBUG: 11132: Commandline: "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4M
2026-05-29 06:44:52,784 [root] DEBUG: 11132: hook_api: LdrpCallInitRoutine export address 0x77812B50 obtained via GetFunctionAddress
2026-05-29 06:44:52,802 [root] DEBUG: 11132: hook_api: Trampoline creation failed for GetCommandLineA, retrying with HOOK_SAFEST
2026-05-29 06:44:52,803 [root] DEBUG: 11132: hook_api: Trampoline creation failed for GetCommandLineW, retrying with HOOK_SAFEST
2026-05-29 06:44:52,807 [root] DEBUG: 11132: Hooked 632 out of 632 functions
2026-05-29 06:44:52,808 [root] DEBUG: 11132: Syscall hook installed, syscall logging level 1
2026-05-29 06:44:52,812 [root] DEBUG: 11132: RestoreHeaders: Restored original import table.
2026-05-29 06:44:52,812 [root] INFO: Loaded monitor into process with pid 11132
2026-05-29 06:44:52,813 [root] DEBUG: 11132: caller_dispatch: Added region at 0x00150000 to tracked regions list (kernel32::LoadLibraryExW returns to 0x0015D98E, thread 11136).
2026-05-29 06:44:52,814 [root] DEBUG: 11132: YaraScan: Scanning 0x00150000, size 0x34220
2026-05-29 06:44:52,815 [root] DEBUG: 11132: ProcessImageBase: Main module image at 0x00150000 unmodified (entropy change 0.000000e+00)
2026-05-29 06:44:52,818 [root] DEBUG: 11132: DLL loaded at 0x74A30000: C:\Windows\SYSTEM32\Wldp (0x24000 bytes).
2026-05-29 06:44:52,819 [root] DEBUG: 11132: DLL loaded at 0x74A60000: C:\Windows\SYSTEM32\windows.storage (0x613000 bytes).
2026-05-29 06:44:52,820 [root] DEBUG: 11132: DLL loaded at 0x75F00000: C:\Windows\System32\SHCORE (0x87000 bytes).
2026-05-29 06:44:52,823 [root] DEBUG: 11132: DLL loaded at 0x70670000: C:\Windows\SYSTEM32\NETAPI32 (0x14000 bytes).
2026-05-29 06:44:52,824 [root] DEBUG: 11132: DLL loaded at 0x75460000: C:\Windows\SYSTEM32\VERSION (0x8000 bytes).
2026-05-29 06:44:52,824 [root] DEBUG: 11132: DLL loaded at 0x75450000: C:\Windows\SYSTEM32\WTSAPI32 (0xf000 bytes).
2026-05-29 06:44:52,825 [root] DEBUG: 11132: DLL loaded at 0x74890000: C:\Windows\SYSTEM32\NETUTILS (0xb000 bytes).
2026-05-29 06:44:52,825 [root] DEBUG: 11132: DLL loaded at 0x748A0000: C:\Windows\SYSTEM32\WKSCLI (0x11000 bytes).
2026-05-29 06:44:52,826 [root] DEBUG: 11132: DLL loaded at 0x6AEB0000: C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.233.3\msedgeupdate (0x23d000 bytes).
2026-05-29 06:44:52,832 [root] DEBUG: 11132: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-29 06:44:52,833 [root] DEBUG: 11132: DLL loaded at 0x6A970000: C:\Windows\system32\MDMRegistration (0x53000 bytes).
2026-05-29 06:44:52,839 [root] DEBUG: 11132: DLL loaded at 0x6F2A0000: C:\Windows\SYSTEM32\powrprof (0x44000 bytes).
2026-05-29 06:44:52,840 [root] DEBUG: 11132: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\CRYPTSP (0x13000 bytes).
2026-05-29 06:44:52,841 [root] DEBUG: 11132: DLL loaded at 0x70D00000: C:\Windows\SYSTEM32\ncrypt (0x21000 bytes).
2026-05-29 06:44:52,841 [root] DEBUG: 11132: DLL loaded at 0x76790000: C:\Windows\System32\imagehlp (0x19000 bytes).
2026-05-29 06:44:52,842 [root] DEBUG: 11132: DLL loaded at 0x6A8E0000: C:\Windows\SYSTEM32\tbs (0x13000 bytes).
2026-05-29 06:44:52,842 [root] DEBUG: 11132: DLL loaded at 0x6A900000: C:\Windows\SYSTEM32\DMCmnUtils (0x63000 bytes).
2026-05-29 06:44:52,843 [root] DEBUG: 11132: DLL loaded at 0x754B0000: C:\Windows\SYSTEM32\omadmapi (0x2c000 bytes).
2026-05-29 06:44:52,849 [root] DEBUG: 11132: DLL loaded at 0x6F290000: C:\Windows\SYSTEM32\UMPDC (0xd000 bytes).
2026-05-29 06:44:52,851 [root] DEBUG: 11132: DLL loaded at 0x70200000: C:\Windows\SYSTEM32\NTASN1 (0x28000 bytes).
2026-05-29 06:44:52,854 [root] DEBUG: 11132: DLL loaded at 0x6EBD0000: C:\Windows\SYSTEM32\msvcp110_win (0x65000 bytes).
2026-05-29 06:44:52,854 [root] DEBUG: 11132: DLL loaded at 0x741D0000: C:\Windows\SYSTEM32\cryptsp (0x13000 bytes).
2026-05-29 06:44:52,855 [root] DEBUG: 11132: DLL loaded at 0x6EC40000: C:\Windows\SYSTEM32\DSREG (0x107000 bytes).
2026-05-29 06:44:52,859 [root] DEBUG: 11132: DLL loaded at 0x74180000: C:\Windows\SYSTEM32\profapi (0x1c000 bytes).
2026-05-29 06:44:52,880 [root] DEBUG: 11132: DLL loaded at 0x74950000: C:\Windows\SYSTEM32\kernel.appcore (0xf000 bytes).
2026-05-29 06:44:52,881 [root] DEBUG: 11132: DLL loaded at 0x75DF0000: C:\Windows\System32\bcryptPrimitives (0x5f000 bytes).
2026-05-29 06:44:52,884 [root] DEBUG: 11132: DLL loaded at 0x6AE60000: C:\Windows\SYSTEM32\WINSTA (0x47000 bytes).
2026-05-29 06:44:52,890 [root] DEBUG: 11132: DLL loaded at 0x73FA0000: C:\Windows\SYSTEM32\Iphlpapi (0x32000 bytes).
2026-05-29 06:44:52,891 [root] DEBUG: 11132: DLL loaded at 0x76290000: C:\Windows\System32\NSI (0x7000 bytes).
2026-05-29 06:44:52,893 [root] DEBUG: 11132: DLL loaded at 0x73F80000: C:\Windows\SYSTEM32\dhcpcsvc (0x16000 bytes).
2026-05-29 06:44:52,895 [root] DEBUG: 11132: CreateThreadBreakpoints: Failed to open thread and get a handle.
2026-05-29 06:44:52,895 [root] DEBUG: 11132: CreateThreadBreakpoints: Failed to open thread and get a handle.
2026-05-29 06:44:52,898 [root] DEBUG: 11132: DLL loaded at 0x73E90000: C:\Windows\SYSTEM32\diagnosticdataquery (0xc000 bytes).
2026-05-29 06:44:52,899 [root] DEBUG: 11132: DLL loaded at 0x76650000: C:\Windows\System32\clbcatq (0x7e000 bytes).
2026-05-29 06:44:52,900 [root] DEBUG: 11132: DLL loaded at 0x6F0B0000: C:\Windows\System32\msxml6 (0x1dd000 bytes).
2026-05-29 06:44:52,906 [root] DEBUG: 11132: DLL loaded at 0x73EB0000: C:\Windows\System32\netprofm (0x32000 bytes).
2026-05-29 06:44:52,916 [root] DEBUG: 11132: DLL loaded at 0x73EA0000: C:\Windows\System32\npmproxy (0xa000 bytes).
2026-05-29 06:44:52,932 [root] DEBUG: 11132: DLL loaded at 0x75340000: C:\Windows\system32\winhttp (0xca000 bytes).
2026-05-29 06:44:52,934 [root] DEBUG: 11132: DLL loaded at 0x6E3B0000: C:\Windows\system32\OnDemandConnRouteHelper (0x12000 bytes).
2026-05-29 06:44:52,938 [root] DEBUG: 11132: DLL loaded at 0x6BC10000: C:\Windows\SYSTEM32\dhcpcsvc6 (0x14000 bytes).
2026-05-29 06:44:52,950 [root] DEBUG: 11132: DLL loaded at 0x6A9D0000: C:\Windows\SYSTEM32\webio (0x73000 bytes).
2026-05-29 06:44:52,951 [root] DEBUG: 11132: DLL loaded at 0x6E350000: C:\Windows\system32\mswsock (0x52000 bytes).
2026-05-29 06:44:52,952 [root] DEBUG: 11132: DLL loaded at 0x6E2F0000: C:\Windows\SYSTEM32\WINNSI (0x8000 bytes).
2026-05-29 06:44:52,957 [root] DEBUG: 11132: DLL loaded at 0x702C0000: C:\Windows\SYSTEM32\DNSAPI (0x90000 bytes).
2026-05-29 06:44:52,958 [root] DEBUG: 11132: DLL loaded at 0x6D030000: C:\Windows\System32\rasadhlp (0x8000 bytes).
2026-05-29 06:44:52,983 [root] DEBUG: 11132: DLL loaded at 0x6CFD0000: C:\Windows\System32\fwpuclnt (0x58000 bytes).
2026-05-29 06:44:53,005 [root] DEBUG: 11132: DLL loaded at 0x6CF50000: C:\Windows\System32\schannel (0x7c000 bytes).
2026-05-29 06:44:53,029 [root] DEBUG: 11132: DLL loaded at 0x6CF40000: C:\Windows\SYSTEM32\mskeyprotect (0x10000 bytes).
2026-05-29 06:44:53,029 [root] DEBUG: 11132: DLL loaded at 0x70200000: C:\Windows\SYSTEM32\NTASN1 (0x28000 bytes).
2026-05-29 06:44:53,030 [root] DEBUG: 11132: DLL loaded at 0x70D00000: C:\Windows\SYSTEM32\ncrypt (0x21000 bytes).
2026-05-29 06:44:53,031 [root] DEBUG: 11132: DLL loaded at 0x6CEF0000: C:\Windows\system32\ncryptsslp (0x1f000 bytes).
2026-05-29 06:44:53,033 [root] DEBUG: 11132: DLL loaded at 0x701B0000: C:\Windows\SYSTEM32\MSASN1 (0xe000 bytes).
2026-05-29 06:44:53,263 [root] DEBUG: 11132: DLL loaded at 0x6E2E0000: C:\Windows\SYSTEM32\DPAPI (0x8000 bytes).
2026-05-29 06:44:53,269 [root] INFO: Added new file to list with pid 11132 and path C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
2026-05-29 06:44:53,270 [root] DEBUG: 11132: NtTerminateProcess hook: Attempting to dump process 11132
2026-05-29 06:44:53,271 [root] DEBUG: 11132: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:44:53,276 [root] INFO: Process with pid 11132 has terminated
2026-05-29 06:44:53,285 [root] DEBUG: 5932: NtTerminateProcess hook: Attempting to dump process 5932
2026-05-29 06:44:53,285 [root] DEBUG: 5932: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:44:53,293 [root] INFO: Process with pid 5932 has terminated
2026-05-29 06:44:55,897 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 11408: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:44:55,899 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 11408
2026-05-29 06:44:55,900 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 11408
2026-05-29 06:45:20,815 [root] DEBUG: 4484: DLL loaded at 0x00007FFF4C1E0000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-29 06:45:20,823 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 11836: C:\Windows\System32\SecurityHealthHost.exe, ImageBase: 0x00007FF652CF0000
2026-05-29 06:45:20,824 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 11836
2026-05-29 06:45:20,824 [lib.api.process] INFO: Monitor config for process 11836: C:\lpw_albt\dll\11836.ini
2026-05-29 06:45:20,826 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:20,828 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:20,835 [root] DEBUG: Loader: Injecting process 11836 (thread 11840) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:20,836 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:45:20,836 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:20,838 [lib.api.process] INFO: Injected into 64-bit <Process 11836 SecurityHealthHost.exe>
2026-05-29 06:45:20,840 [root] INFO: Announced 64-bit process name: SecurityHealthHost.exe pid: 11836
2026-05-29 06:45:20,840 [lib.api.process] INFO: Monitor config for process 11836: C:\lpw_albt\dll\11836.ini
2026-05-29 06:45:20,840 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:20,842 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:20,846 [root] DEBUG: Loader: Injecting process 11836 (thread 11840) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:20,846 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:45:20,847 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:20,848 [lib.api.process] INFO: Injected into 64-bit <Process 11836 SecurityHealthHost.exe>
2026-05-29 06:45:20,858 [root] DEBUG: 11836: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:45:20,859 [root] DEBUG: 11836: Interactive desktop enabled.
2026-05-29 06:45:20,859 [root] DEBUG: 11836: Dropped file limit defaulting to 100.
2026-05-29 06:45:20,862 [root] DEBUG: 11836: Disabling sleep skipping.
2026-05-29 06:45:20,864 [root] DEBUG: 11836: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:45:20,876 [root] DEBUG: 11836: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:45:20,876 [root] DEBUG: 11836: YaraScan: Scanning 0x00007FF652CF0000, size 0x19174
2026-05-29 06:45:20,877 [root] DEBUG: 11836: Monitor initialised: 64-bit capemon loaded in process 11836 at 0x00007FFF18240000, thread 11840, image base 0x00007FF652CF0000, stack from 0x000000E02A964000-0x000000E02A970000
2026-05-29 06:45:20,878 [root] DEBUG: 11836: Commandline: C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
2026-05-29 06:45:20,890 [root] DEBUG: 11836: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-29 06:45:20,913 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-29 06:45:20,914 [root] DEBUG: 11836: set_hooks: Unable to hook LockResource
2026-05-29 06:45:20,920 [root] DEBUG: 11836: Hooked 627 out of 628 functions
2026-05-29 06:45:20,922 [root] DEBUG: 11836: Syscall hook installed, syscall logging level 1
2026-05-29 06:45:20,933 [root] DEBUG: 11836: RestoreHeaders: Restored original import table.
2026-05-29 06:45:20,933 [root] INFO: Loaded monitor into process with pid 11836
2026-05-29 06:45:20,934 [root] DEBUG: 11836: caller_dispatch: Added region at 0x00007FF652CF0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF652CFD3B2, thread 11840).
2026-05-29 06:45:20,935 [root] DEBUG: 11836: YaraScan: Scanning 0x00007FF652CF0000, size 0x19174
2026-05-29 06:45:20,937 [root] DEBUG: 11836: ProcessImageBase: Main module image at 0x00007FF652CF0000 unmodified (entropy change 0.000000e+00)
2026-05-29 06:45:20,940 [root] DEBUG: 11836: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-29 06:45:20,941 [root] DEBUG: 11836: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-29 06:45:20,943 [root] DEBUG: 11836: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-29 06:45:20,961 [root] DEBUG: 11836: DLL loaded at 0x00007FFF56FA0000: C:\Windows\system32\Wldp (0x2d000 bytes).
2026-05-29 06:45:20,962 [root] DEBUG: 11836: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:20,962 [root] DEBUG: 11836: DLL loaded at 0x00007FFF18110000: C:\Windows\system32\SecurityHealthAgent (0x6d000 bytes).
2026-05-29 06:45:20,977 [root] DEBUG: 11836: DLL loaded at 0x00007FFF4C1E0000: C:\Windows\system32\SecurityHealthProxyStub (0x1f000 bytes).
2026-05-29 06:45:20,984 [root] DEBUG: 11836: DLL loaded at 0x00007FFF52B60000: C:\Windows\System32\msxml6 (0x25f000 bytes).
2026-05-29 06:45:20,995 [root] DEBUG: 11836: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-29 06:45:20,996 [root] DEBUG: 11836: DLL loaded at 0x00007FFF52DC0000: C:\Windows\SYSTEM32\wintypes (0x155000 bytes).
2026-05-29 06:45:20,997 [root] DEBUG: 11836: DLL loaded at 0x00007FFF55410000: C:\Windows\System32\RMCLIENT (0x2a000 bytes).
2026-05-29 06:45:20,998 [root] DEBUG: 11836: DLL loaded at 0x00007FFF523E0000: C:\Windows\System32\XmlLite (0x36000 bytes).
2026-05-29 06:45:20,999 [root] DEBUG: 11836: DLL loaded at 0x00007FFF517C0000: C:\Windows\System32\twinapi.appcore (0x203000 bytes).
2026-05-29 06:45:20,999 [root] DEBUG: 11836: DLL loaded at 0x00007FFF40FB0000: C:\Windows\System32\wpnapps (0x15b000 bytes).
2026-05-29 06:45:21,008 [root] DEBUG: 11836: DLL loaded at 0x00007FFF52490000: C:\Windows\SYSTEM32\usermgrcli (0x16000 bytes).
2026-05-29 06:45:21,019 [root] DEBUG: 11836: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-29 06:45:21,031 [root] DEBUG: 11836: DLL loaded at 0x00007FFF3FD40000: C:\Windows\System32\ShellCommonCommonProxyStub (0xe4000 bytes).
2026-05-29 06:45:21,064 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE131000, size: 0x1000.
2026-05-29 06:45:21,065 [root] DEBUG: 11836: NtTerminateProcess hook: Attempting to dump process 11836
2026-05-29 06:45:21,066 [root] DEBUG: 11836: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:45:21,072 [root] DEBUG: 4484: AllocationHandler: Adding allocation to tracked region list: 0x00007DF4AE121000, size: 0x1000.
2026-05-29 06:45:21,078 [root] INFO: Process with pid 11836 has terminated
2026-05-29 06:45:21,079 [root] DEBUG: 4484: AllocationHandler: Allocation already in tracked region list: 0x00007DF4AE130000.
2026-05-29 06:45:21,129 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 12232: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe, ImageBase: 0x00007FF65DCB0000
2026-05-29 06:45:21,130 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 12232
2026-05-29 06:45:21,131 [lib.api.process] INFO: Monitor config for process 12232: C:\lpw_albt\dll\12232.ini
2026-05-29 06:45:21,133 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:21,857 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:21,862 [root] DEBUG: Loader: Injecting process 12232 (thread 12236) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:21,863 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:45:21,864 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:21,865 [lib.api.process] INFO: Injected into 64-bit <Process 12232 ShellExperienceHost.exe>
2026-05-29 06:45:21,867 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 12232
2026-05-29 06:45:21,867 [lib.api.process] INFO: Monitor config for process 12232: C:\lpw_albt\dll\12232.ini
2026-05-29 06:45:21,868 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:22,234 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 10244: C:\Windows\system32\sppsvc.exe, ImageBase: 0x0000000000000000
2026-05-29 06:45:22,235 [lib.api.process] WARNING: OpenThread(THREAD_ALL_ACCESS, ...) failed for thread 10272
2026-05-29 06:45:22,235 [root] INFO: Announced 64-bit process name: sppsvc.exe pid: 10244
2026-05-29 06:45:22,236 [lib.api.process] INFO: Monitor config for process 10244: C:\lpw_albt\dll\10244.ini
2026-05-29 06:45:22,237 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:22,240 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:22,245 [root] DEBUG: Loader: Injecting process 10244 (thread 10272) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,247 [root] DEBUG: Loader: Copied config file C:\lpw_albt\dll\10244.ini to system path C:\10244.ini
2026-05-29 06:45:22,248 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 10244 C:\lpw_albt\dll\yCvZHFYF.dll
2026-05-29 06:45:22,249 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,251 [lib.api.process] INFO: Injected into 64-bit <Process 10244 sppsvc.exe>
2026-05-29 06:45:22,252 [lib.api.process] WARNING: OpenThread(THREAD_ALL_ACCESS, ...) failed for thread 10272
2026-05-29 06:45:22,252 [root] INFO: Announced 64-bit process name: sppsvc.exe pid: 10244
2026-05-29 06:45:22,253 [lib.api.process] INFO: Monitor config for process 10244: C:\lpw_albt\dll\10244.ini
2026-05-29 06:45:22,254 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:22,257 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:22,262 [root] DEBUG: Loader: Injecting process 10244 (thread 10272) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,264 [root] DEBUG: Loader: Copied config file C:\lpw_albt\dll\10244.ini to system path C:\10244.ini
2026-05-29 06:45:22,266 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 10244 C:\lpw_albt\dll\yCvZHFYF.dll
2026-05-29 06:45:22,267 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,268 [lib.api.process] INFO: Injected into 64-bit <Process 10244 sppsvc.exe>
2026-05-29 06:45:22,270 [root] INFO: Announced 64-bit process name: sppsvc.exe pid: 10244
2026-05-29 06:45:22,270 [lib.api.process] INFO: Monitor config for process 10244: C:\lpw_albt\dll\10244.ini
2026-05-29 06:45:22,271 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:22,274 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:22,281 [root] DEBUG: Loader: Injecting process 10244 with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,282 [root] DEBUG: Loader: Copied config file C:\lpw_albt\dll\10244.ini to system path C:\10244.ini
2026-05-29 06:45:22,284 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 10244 C:\lpw_albt\dll\yCvZHFYF.dll
2026-05-29 06:45:22,285 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,286 [lib.api.process] INFO: Injected into 64-bit <Process 10244 sppsvc.exe>
2026-05-29 06:45:22,294 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 9388: C:\Windows\System32\svchost.exe, ImageBase: 0x00007FF7BF220000
2026-05-29 06:45:22,295 [root] INFO: Announced 64-bit process name: svchost.exe pid: 9388
2026-05-29 06:45:22,295 [lib.api.process] INFO: Monitor config for process 9388: C:\lpw_albt\dll\9388.ini
2026-05-29 06:45:22,296 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:22,300 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:22,305 [root] DEBUG: Loader: Injecting process 9388 (thread 9348) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,306 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:45:22,307 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,310 [lib.api.process] INFO: Injected into 64-bit <Process 9388 svchost.exe>
2026-05-29 06:45:22,312 [root] INFO: Announced 64-bit process name: svchost.exe pid: 9388
2026-05-29 06:45:22,312 [lib.api.process] INFO: Monitor config for process 9388: C:\lpw_albt\dll\9388.ini
2026-05-29 06:45:22,313 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:22,317 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:22,324 [root] DEBUG: Loader: Injecting process 9388 (thread 9348) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,325 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:45:22,326 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,328 [lib.api.process] INFO: Injected into 64-bit <Process 9388 svchost.exe>
2026-05-29 06:45:22,329 [root] INFO: Announced 64-bit process name: svchost.exe pid: 9388
2026-05-29 06:45:22,330 [lib.api.process] INFO: Monitor config for process 9388: C:\lpw_albt\dll\9388.ini
2026-05-29 06:45:22,331 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:22,335 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:22,340 [root] DEBUG: Loader: Injecting process 9388 with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,341 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 9348, handle 0x120
2026-05-29 06:45:22,341 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:45:22,342 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,344 [lib.api.process] INFO: Injected into 64-bit <Process 9388 svchost.exe>
2026-05-29 06:45:22,352 [root] DEBUG: 9388: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:45:22,353 [root] DEBUG: 9388: Interactive desktop enabled.
2026-05-29 06:45:22,355 [root] DEBUG: 9388: Dropped file limit defaulting to 100.
2026-05-29 06:45:22,355 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56140000: C:\Windows\SYSTEM32\sppc (0x25000 bytes).
2026-05-29 06:45:22,356 [root] DEBUG: 4104: DLL loaded at 0x00007FFF56170000: C:\Windows\system32\slc (0x29000 bytes).
2026-05-29 06:45:22,358 [root] DEBUG: 9388: Disabling sleep skipping.
2026-05-29 06:45:22,359 [root] DEBUG: 4104: DLL loaded at 0x00007FFF17400000: C:\Windows\system32\slwga (0x19000 bytes).
2026-05-29 06:45:22,360 [root] DEBUG: 9388: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:45:22,373 [root] DEBUG: 9388: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:45:22,374 [root] DEBUG: 9388: YaraScan: Scanning 0x00007FF7BF220000, size 0xf06a
2026-05-29 06:45:22,375 [root] DEBUG: 9388: Monitor initialised: 64-bit capemon loaded in process 9388 at 0x00007FFF18240000, thread 9348, image base 0x00007FF7BF220000, stack from 0x000000EA5B274000-0x000000EA5B280000
2026-05-29 06:45:22,376 [root] DEBUG: 9388: Commandline: C:\Windows\System32\svchost.exe -k WerSvcGroup
2026-05-29 06:45:22,387 [root] DEBUG: 4104: DLL loaded at 0x00007FFF17220000: C:\Windows\System32\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient (0x12000 bytes).
2026-05-29 06:45:22,388 [root] DEBUG: 9388: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-29 06:45:22,410 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-29 06:45:22,411 [root] DEBUG: 9388: set_hooks: Unable to hook LockResource
2026-05-29 06:45:22,415 [root] DEBUG: 9388: Hooked 627 out of 628 functions
2026-05-29 06:45:22,417 [root] DEBUG: 9388: Syscall hook installed, syscall logging level 1
2026-05-29 06:45:22,421 [root] DEBUG: 9388: RestoreHeaders: Restored original import table.
2026-05-29 06:45:22,422 [root] INFO: Loaded monitor into process with pid 9388
2026-05-29 06:45:22,423 [root] DEBUG: 9388: caller_dispatch: Added region at 0x00007FF7BF220000 to tracked regions list (kernel32::GetCommandLineW returns to 0x00007FF7BF2250EA, thread 9348).
2026-05-29 06:45:22,423 [root] DEBUG: 9388: YaraScan: Scanning 0x00007FF7BF220000, size 0xf06a
2026-05-29 06:45:22,424 [root] DEBUG: 9388: ProcessImageBase: Main module image at 0x00007FF7BF220000 unmodified (entropy change 0.000000e+00)
2026-05-29 06:45:22,433 [root] DEBUG: 9388: DLL loaded at 0x00007FFF523E0000: c:\windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:22,434 [root] DEBUG: 9388: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-29 06:45:22,435 [root] DEBUG: 9388: DLL loaded at 0x00007FFF3E0F0000: c:\windows\system32\WindowsPerformanceRecorderControl (0x12d000 bytes).
2026-05-29 06:45:22,436 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 1196: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:45:22,436 [root] DEBUG: 9388: DLL loaded at 0x00007FFF17190000: c:\windows\system32\WerEtw (0x3f000 bytes).
2026-05-29 06:45:22,437 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1196
2026-05-29 06:45:22,438 [root] DEBUG: 9388: DLL loaded at 0x00007FFF171D0000: c:\windows\system32\wersvc (0x45000 bytes).
2026-05-29 06:45:22,438 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 1196
2026-05-29 06:45:22,442 [root] DEBUG: 9388: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\WLDP (0x2d000 bytes).
2026-05-29 06:45:22,447 [root] DEBUG: 9388: DLL loaded at 0x00007FFF55330000: C:\Windows\System32\wer (0xde000 bytes).
2026-05-29 06:45:22,455 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,456 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,461 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,462 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,466 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,467 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,479 [root] DEBUG: 9388: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-29 06:45:22,488 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,489 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,494 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,494 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:22,495 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,499 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,500 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,500 [root] DEBUG: Loader: Injecting process 12232 (thread 12236) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,501 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:45:22,502 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:22,505 [lib.api.process] INFO: Injected into 64-bit <Process 12232 ShellExperienceHost.exe>
2026-05-29 06:45:22,506 [root] INFO: Announced 64-bit process name: ShellExperienceHost.exe pid: 12232
2026-05-29 06:45:22,506 [lib.api.process] INFO: Monitor config for process 12232: C:\lpw_albt\dll\12232.ini
2026-05-29 06:45:22,507 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:22,512 [root] DEBUG: 9388: OpenProcessHandler: Injection info created for process 8756, handle 0x2a4: C:\lpw_albt\bin\PPLinject64.exe
2026-05-29 06:45:22,513 [root] DEBUG: 9388: OpenProcessHandler: Image base for process 8756 (handle 0x2a4): 0x00007FF68CAE0000.
2026-05-29 06:45:22,517 [root] DEBUG: 9388: DLL loaded at 0x00007FFF55710000: C:\Windows\SYSTEM32\windows.storage (0x79b000 bytes).
2026-05-29 06:45:22,519 [root] DEBUG: 9388: CreateProcessHandler: Injection info set for new process 2104: C:\Windows\system32\WerFault.exe, ImageBase: 0x00007FF78EB10000
2026-05-29 06:45:22,520 [root] DEBUG: 9388: ProcessMessage: Skipping monitoring process 2104
2026-05-29 06:45:22,525 [root] DEBUG: 9388: ProcessMessage: Skipping monitoring process 2104
2026-05-29 06:45:22,609 [root] DEBUG: 9388: DLL loaded at 0x00007FFF47530000: c:\windows\system32\dbghelp (0x1e4000 bytes).
2026-05-29 06:45:22,610 [root] DEBUG: 9388: DLL loaded at 0x00007FFF474F0000: c:\windows\system32\dbgcore (0x34000 bytes).
2026-05-29 06:45:22,611 [root] DEBUG: 9388: DLL loaded at 0x00007FFF46350000: c:\windows\system32\faultrep (0x7b000 bytes).
2026-05-29 06:45:22,615 [root] DEBUG: 9388: DLL loaded at 0x00007FFF55330000: c:\windows\system32\wer (0xde000 bytes).
2026-05-29 06:45:22,622 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,623 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,630 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,631 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,634 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,636 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,641 [root] DEBUG: 4104: DLL loaded at 0x00007FFEFBAE0000: C:\Windows\System32\CloudExperienceHostCommon (0x128000 bytes).
2026-05-29 06:45:22,652 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,653 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,658 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,658 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,663 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,664 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,677 [root] DEBUG: 9388: DLL loaded at 0x00007FFF57520000: c:\windows\system32\USERENV (0x2e000 bytes).
2026-05-29 06:45:22,679 [root] DEBUG: 9388: DLL loaded at 0x00007FFF57560000: c:\windows\system32\profapi (0x25000 bytes).
2026-05-29 06:45:22,690 [root] DEBUG: 9388: CreateProcessHandler: Injection info set for new process 7024: C:\Windows\system32\WerFault.exe, ImageBase: 0x00007FF78EB10000
2026-05-29 06:45:22,692 [root] DEBUG: 9388: ProcessMessage: Skipping monitoring process 7024
2026-05-29 06:45:22,694 [root] DEBUG: 9388: ProcessMessage: Skipping monitoring process 7024
2026-05-29 06:45:22,880 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,881 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,884 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,885 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,888 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,889 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,897 [root] INFO: Error dumping file from path "C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3DE.tmp": [Errno 13] Permission denied: 'C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp'
2026-05-29 06:45:22,898 [root] INFO: Error dumping file from path "C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3DE.tmp": [Errno 13] Permission denied: 'C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC3DE.tmp'
2026-05-29 06:45:22,918 [root] DEBUG: 9388: api-rate-cap: NtWriteFile hook disabled due to rate
2026-05-29 06:45:22,936 [root] INFO: Added new file to list with pid 9388 and path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3DE.tmp.csv
2026-05-29 06:45:22,942 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,943 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,947 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,948 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,953 [root] DEBUG: 9388: DLL loaded at 0x00007FFF566C0000: C:\Windows\SYSTEM32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:22,954 [root] DEBUG: 9388: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:22,961 [root] INFO: Error dumping file from path "C:\ProgramData\Microsoft\Windows\WER\Temp\WERC41D.tmp": [Errno 13] Permission denied: 'C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp'
2026-05-29 06:45:22,963 [root] INFO: Error dumping file from path "C:\ProgramData\Microsoft\Windows\WER\Temp\WERC41D.tmp": [Errno 13] Permission denied: 'C:\\ProgramData\\Microsoft\\Windows\\WER\\Temp\\WERC41D.tmp'
2026-05-29 06:45:22,968 [root] INFO: Added new file to list with pid 9388 and path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC41D.tmp.txt
2026-05-29 06:45:23,086 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:23,092 [root] DEBUG: Loader: Injecting process 12232 with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:23,093 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 12236, handle 0x120
2026-05-29 06:45:23,094 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:45:23,094 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:23,096 [lib.api.process] INFO: Injected into 64-bit <Process 12232 ShellExperienceHost.exe>
2026-05-29 06:45:42,448 [root] INFO: Announced starting service "b'wisvc'"
2026-05-29 06:45:43,465 [root] DEBUG: 676: CreateProcessHandler: Injection info set for new process 12224: C:\Windows\system32\svchost.exe, ImageBase: 0x00007FF7BF220000
2026-05-29 06:45:43,466 [root] INFO: Announced 64-bit process name: svchost.exe pid: 12224
2026-05-29 06:45:43,467 [lib.api.process] INFO: Monitor config for process 12224: C:\lpw_albt\dll\12224.ini
2026-05-29 06:45:43,468 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:43,471 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:43,476 [root] DEBUG: Loader: Injecting process 12224 (thread 12228) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:43,477 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:45:43,478 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:43,479 [lib.api.process] INFO: Injected into 64-bit <Process 12224 svchost.exe>
2026-05-29 06:45:43,481 [root] INFO: Announced 64-bit process name: svchost.exe pid: 12224
2026-05-29 06:45:43,481 [lib.api.process] INFO: Monitor config for process 12224: C:\lpw_albt\dll\12224.ini
2026-05-29 06:45:43,482 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:43,485 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:43,489 [root] DEBUG: Loader: Injecting process 12224 (thread 12228) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:43,490 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:45:43,491 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:43,492 [lib.api.process] INFO: Injected into 64-bit <Process 12224 svchost.exe>
2026-05-29 06:45:43,493 [root] INFO: Announced 64-bit process name: svchost.exe pid: 12224
2026-05-29 06:45:43,494 [lib.api.process] INFO: Monitor config for process 12224: C:\lpw_albt\dll\12224.ini
2026-05-29 06:45:43,495 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:43,499 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:43,503 [root] DEBUG: Loader: Injecting process 12224 with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:43,504 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 12228, handle 0x120
2026-05-29 06:45:43,505 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2026-05-29 06:45:43,505 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:43,507 [lib.api.process] INFO: Injected into 64-bit <Process 12224 svchost.exe>
2026-05-29 06:45:43,520 [root] DEBUG: 12224: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:45:43,521 [root] DEBUG: 12224: Interactive desktop enabled.
2026-05-29 06:45:43,522 [root] DEBUG: 12224: Dropped file limit defaulting to 100.
2026-05-29 06:45:43,522 [root] DEBUG: 12224: Disabling sleep skipping.
2026-05-29 06:45:43,523 [root] DEBUG: 12224: Services hook set enabled
2026-05-29 06:45:43,526 [root] DEBUG: 12224: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:45:43,537 [root] DEBUG: 12224: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:45:43,538 [root] DEBUG: 12224: Monitor initialised: 64-bit capemon loaded in process 12224 at 0x00007FFF18240000, thread 12228, image base 0x00007FF7BF220000, stack from 0x00000081BD184000-0x00000081BD190000
2026-05-29 06:45:43,539 [root] DEBUG: 12224: Commandline: C:\Windows\system32\svchost.exe -k netsvcs -p
2026-05-29 06:45:43,555 [root] DEBUG: 12224: Hooked 69 out of 69 functions
2026-05-29 06:45:43,557 [root] DEBUG: 12224: RestoreHeaders: Restored original import table.
2026-05-29 06:45:43,558 [root] INFO: Loaded monitor into process with pid 12224
2026-05-29 06:45:43,559 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-29 06:45:43,560 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-29 06:45:43,561 [root] DEBUG: 12224: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-29 06:45:43,564 [root] DEBUG: 12224: DLL loaded at 0x00007FFF40A10000: c:\windows\system32\flightsettings (0xe6000 bytes).
2026-05-29 06:45:43,564 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56FA0000: C:\Windows\SYSTEM32\WLDP (0x2d000 bytes).
2026-05-29 06:45:43,568 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52B00000: C:\Windows\SYSTEM32\wtsapi32 (0x14000 bytes).
2026-05-29 06:45:43,570 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57360000: C:\Windows\SYSTEM32\WINSTA (0x5b000 bytes).
2026-05-29 06:45:43,571 [root] DEBUG: 12224: DLL loaded at 0x00007FFF50870000: C:\Windows\System32\OneCoreUAPCommonProxyStub (0x7d0000 bytes).
2026-05-29 06:45:43,573 [root] DEBUG: 12224: DLL loaded at 0x00007FFF48780000: C:\Windows\System32\OneCoreCommonProxyStub (0x7f000 bytes).
2026-05-29 06:45:43,576 [root] DEBUG: 12224: DLL loaded at 0x00007FFF566C0000: c:\windows\system32\msvcp110_win (0x8a000 bytes).
2026-05-29 06:45:43,576 [root] DEBUG: 12224: DLL loaded at 0x00007FFF522D0000: C:\Windows\SYSTEM32\policymanager (0xa1000 bytes).
2026-05-29 06:45:43,578 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56EF0000: C:\Windows\SYSTEM32\cryptsp (0x18000 bytes).
2026-05-29 06:45:43,578 [root] DEBUG: 12224: DLL loaded at 0x00007FFF188A0000: C:\Windows\System32\wosc (0x4e000 bytes).
2026-05-29 06:45:43,585 [root] DEBUG: 12224: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-29 06:45:43,585 [root] DEBUG: 12224: DLL loaded at 0x00007FFF42490000: C:\Windows\System32\Windows.Networking.Connectivity (0xb9000 bytes).
2026-05-29 06:45:43,587 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4F560000: C:\Windows\System32\npmproxy (0x10000 bytes).
2026-05-29 06:45:43,590 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52DC0000: C:\Windows\System32\WinTypes (0x155000 bytes).
2026-05-29 06:45:43,591 [root] DEBUG: 12224: DLL loaded at 0x00007FFF569F0000: C:\Windows\System32\IPHLPAPI (0x3b000 bytes).
2026-05-29 06:45:43,592 [root] DEBUG: 12224: DLL loaded at 0x00007FFF58B20000: C:\Windows\System32\NSI (0x8000 bytes).
2026-05-29 06:45:43,594 [root] DEBUG: 12224: DLL loaded at 0x00007FFF40900000: C:\Windows\System32\dusmapi (0x11000 bytes).
2026-05-29 06:45:43,596 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57560000: C:\Windows\System32\profapi (0x25000 bytes).
2026-05-29 06:45:43,596 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4F590000: C:\Windows\System32\Cabinet (0x29000 bytes).
2026-05-29 06:45:43,597 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57520000: C:\Windows\System32\USERENV (0x2e000 bytes).
2026-05-29 06:45:43,597 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57AA0000: C:\Windows\System32\WINTRUST (0x67000 bytes).
2026-05-29 06:45:43,598 [root] DEBUG: 12224: DLL loaded at 0x00007FFF3EE40000: C:\Windows\System32\UpdatePolicy (0x43000 bytes).
2026-05-29 06:45:43,599 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57130000: C:\Windows\System32\MSASN1 (0x12000 bytes).
2026-05-29 06:45:43,601 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D6A0000: C:\Windows\System32\iertutil (0x2bc000 bytes).
2026-05-29 06:45:43,601 [root] DEBUG: 12224: DLL loaded at 0x00007FFF47980000: C:\Windows\System32\Windows.Web (0xc3000 bytes).
2026-05-29 06:45:43,617 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,617 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,619 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,620 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,620 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,621 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,622 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,623 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,627 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:43,630 [root] DEBUG: 12224: DLL loaded at 0x00007FFF3E220000: C:\Windows\System32\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).
2026-05-29 06:45:43,637 [root] DEBUG: 12224: DLL loaded at 0x00007FFF42C10000: C:\Windows\system32\fcon (0x45000 bytes).
2026-05-29 06:45:43,642 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56630000: C:\Windows\system32\rsaenh (0x34000 bytes).
2026-05-29 06:45:43,660 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,661 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,662 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,663 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,664 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,665 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,665 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,667 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,669 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:43,670 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:43,675 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:43,675 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:43,676 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:43,677 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:43,677 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:43,678 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:43,679 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:43,680 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:43,681 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:43,682 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:43,718 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,719 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,722 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,722 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,723 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,724 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,725 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,726 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,728 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:43,756 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,758 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,760 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,761 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,762 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,763 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,764 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,766 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,769 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:43,770 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:43,772 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:43,774 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:43,774 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:43,775 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:43,777 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:43,778 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:43,779 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:43,780 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:43,781 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:43,781 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:43,808 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,809 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,812 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,813 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,814 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,814 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,815 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,816 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,817 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:43,841 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,842 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,843 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,844 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,845 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,845 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,846 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,846 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,848 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:43,849 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:43,852 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:43,852 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:43,853 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:43,854 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:43,855 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:43,856 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:43,856 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:43,857 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:43,858 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:43,859 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:43,887 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,888 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,890 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,891 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,891 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,892 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,893 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,893 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,895 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:43,922 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,922 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,924 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,924 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,925 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,926 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,927 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,927 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,929 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:43,930 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:43,933 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:43,934 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:43,934 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:43,935 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:43,936 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:43,937 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:43,937 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:43,938 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:43,938 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:43,939 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:43,962 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,963 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,965 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,966 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,966 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,967 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,968 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,969 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:43,970 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:43,992 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:43,992 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:43,994 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:43,995 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:43,996 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:43,996 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:43,997 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:43,998 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,000 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:44,000 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:44,003 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:44,004 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:44,005 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:44,006 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:44,006 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:44,007 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:44,008 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:44,010 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:44,012 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:44,013 [root] DEBUG: 12224: DLL loaded at 0x00007FFF17420000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:44,080 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,081 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,083 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,085 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,086 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,087 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,087 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,089 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,090 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:44,112 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,113 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,114 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,115 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,115 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,116 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,117 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,117 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,119 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:44,120 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:44,123 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:44,124 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:44,124 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:44,125 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:44,126 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:44,126 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:44,127 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:44,127 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:44,128 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:44,129 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:44,152 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,153 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,155 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,156 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,157 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,157 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,158 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,159 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,160 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:44,182 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,183 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,184 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,185 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,186 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,187 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,187 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,188 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,190 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:44,190 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:44,193 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:44,193 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:44,194 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:44,195 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:44,196 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:44,197 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:44,198 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:44,199 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:44,200 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:44,202 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:44,226 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,227 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,229 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,231 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,233 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,233 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,234 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,235 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,237 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:44,260 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,261 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,263 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,264 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,264 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,265 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,266 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,266 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,268 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:44,269 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:44,272 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:44,273 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:44,274 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:44,275 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:44,276 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:44,277 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:44,278 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:44,279 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:44,280 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:44,280 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:44,303 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,304 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,306 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,306 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,308 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,309 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,310 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,310 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,311 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:44,333 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,333 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,335 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,335 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,336 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,337 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,337 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,339 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,341 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:44,341 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:44,344 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:44,344 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:44,345 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:44,346 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:44,346 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:44,347 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:44,348 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:44,348 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:44,349 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:44,351 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:44,380 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,381 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,383 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,384 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,384 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,385 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,386 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,387 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,388 [root] DEBUG: 12224: DLL loaded at 0x00007FFF45630000: C:\Windows\SYSTEM32\AEPIC (0x92000 bytes).
2026-05-29 06:45:44,408 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56B10000: C:\Windows\system32\logoncli (0x43000 bytes).
2026-05-29 06:45:44,409 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C380000: C:\Windows\system32\utcutil (0x1f000 bytes).
2026-05-29 06:45:44,411 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57490000: C:\Windows\SYSTEM32\powrprof (0x4b000 bytes).
2026-05-29 06:45:44,412 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56A30000: C:\Windows\system32\netutils (0xc000 bytes).
2026-05-29 06:45:44,412 [root] DEBUG: 12224: DLL loaded at 0x00007FFF52560000: C:\Windows\system32\WINHTTP (0x10a000 bytes).
2026-05-29 06:45:44,413 [root] DEBUG: 12224: DLL loaded at 0x00007FFF56770000: C:\Windows\SYSTEM32\ntmarta (0x33000 bytes).
2026-05-29 06:45:44,414 [root] DEBUG: 12224: DLL loaded at 0x00007FFF19B10000: C:\Windows\system32\dcntel (0xbf000 bytes).
2026-05-29 06:45:44,414 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57470000: C:\Windows\system32\UMPDC (0x12000 bytes).
2026-05-29 06:45:44,417 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59EF0000: C:\Windows\System32\imagehlp (0x1d000 bytes).
2026-05-29 06:45:44,417 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4FA10000: C:\Windows\SYSTEM32\Tbs (0x1b000 bytes).
2026-05-29 06:45:44,420 [root] DEBUG: 12224: DLL loaded at 0x0000018F1F120000: C:\Windows\system32\WDSCORE (0x43000 bytes).
2026-05-29 06:45:44,421 [root] DEBUG: 12224: DLL loaded at 0x00007FFF1C620000: C:\Windows\system32\MSI (0x337000 bytes).
2026-05-29 06:45:44,421 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43550000: C:\Windows\system32\NETAPI32 (0x19000 bytes).
2026-05-29 06:45:44,422 [root] DEBUG: 12224: DLL loaded at 0x00007FFF523E0000: C:\Windows\system32\XmlLite (0x36000 bytes).
2026-05-29 06:45:44,422 [root] DEBUG: 12224: DLL loaded at 0x00007FFF43500000: C:\Windows\system32\VERSION (0xa000 bytes).
2026-05-29 06:45:44,423 [root] DEBUG: 12224: DLL loaded at 0x00007FFF55FF0000: C:\Windows\system32\tdh (0x11b000 bytes).
2026-05-29 06:45:44,424 [root] DEBUG: 12224: DLL loaded at 0x00007FFF57750000: C:\Windows\System32\cfgmgr32 (0x4e000 bytes).
2026-05-29 06:45:44,424 [root] DEBUG: 12224: DLL loaded at 0x00007FFF59A80000: C:\Windows\System32\setupapi (0x46e000 bytes).
2026-05-29 06:45:44,425 [root] DEBUG: 12224: DLL loaded at 0x00007FFF4D3B0000: C:\Windows\system32\SAMCLI (0x19000 bytes).
2026-05-29 06:45:44,426 [root] DEBUG: 12224: DLL loaded at 0x00007FFF12FC0000: C:\Windows\system32\appraiser (0x212000 bytes).
2026-05-29 06:45:48,832 [root] DEBUG: 832: CreateProcessHandler: Injection info set for new process 13492: C:\Windows\system32\DllHost.exe, ImageBase: 0x00007FF6706B0000
2026-05-29 06:45:48,837 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 13492
2026-05-29 06:45:48,838 [lib.api.process] INFO: Monitor config for process 13492: C:\lpw_albt\dll\13492.ini
2026-05-29 06:45:48,841 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:48,844 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:48,851 [root] DEBUG: Loader: Injecting process 13492 (thread 13496) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:48,853 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:45:48,858 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:48,860 [lib.api.process] INFO: Injected into 64-bit <Process 13492 dllhost.exe>
2026-05-29 06:45:48,861 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 13492
2026-05-29 06:45:48,861 [lib.api.process] INFO: Monitor config for process 13492: C:\lpw_albt\dll\13492.ini
2026-05-29 06:45:48,862 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor
2026-05-29 06:45:48,865 [lib.api.process] INFO: 64-bit DLL to inject is C:\lpw_albt\dll\yCvZHFYF.dll, loader C:\lpw_albt\bin\ibkiRcbt.exe
2026-05-29 06:45:48,870 [root] DEBUG: Loader: Injecting process 13492 (thread 13496) with C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:48,871 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2026-05-29 06:45:48,871 [root] DEBUG: Successfully injected DLL C:\lpw_albt\dll\yCvZHFYF.dll.
2026-05-29 06:45:48,873 [lib.api.process] INFO: Injected into 64-bit <Process 13492 dllhost.exe>
2026-05-29 06:45:48,881 [root] DEBUG: 13492: Python path set to 'C:\Users\admin\AppData\Local\Python\pythoncore-3.14-64'.
2026-05-29 06:45:48,882 [root] DEBUG: 13492: Interactive desktop enabled.
2026-05-29 06:45:48,882 [root] DEBUG: 13492: Dropped file limit defaulting to 100.
2026-05-29 06:45:48,884 [root] DEBUG: 13492: Disabling sleep skipping.
2026-05-29 06:45:48,886 [root] DEBUG: 13492: YaraInit: Compiled rules loaded from existing file C:\lpw_albt\data\yara\capemon.yac
2026-05-29 06:45:48,897 [root] DEBUG: 13492: RtlInsertInvertedFunctionTable 0x00007FFF59F6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF5A0BD4F0
2026-05-29 06:45:48,898 [root] DEBUG: 13492: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026
2026-05-29 06:45:48,899 [root] DEBUG: 13492: Monitor initialised: 64-bit capemon loaded in process 13492 at 0x00007FFF18240000, thread 13496, image base 0x00007FF6706B0000, stack from 0x00000099FF124000-0x00000099FF130000
2026-05-29 06:45:48,900 [root] DEBUG: 13492: Commandline: C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
2026-05-29 06:45:48,911 [root] DEBUG: 13492: hook_api: LdrpCallInitRoutine export address 0x00007FFF59F699BC obtained via GetFunctionAddress
2026-05-29 06:45:48,933 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'
2026-05-29 06:45:48,934 [root] DEBUG: 13492: set_hooks: Unable to hook LockResource
2026-05-29 06:45:48,938 [root] DEBUG: 13492: Hooked 627 out of 628 functions
2026-05-29 06:45:48,940 [root] DEBUG: 13492: Syscall hook installed, syscall logging level 1
2026-05-29 06:45:48,945 [root] DEBUG: 13492: RestoreHeaders: Restored original import table.
2026-05-29 06:45:48,945 [root] INFO: Loaded monitor into process with pid 13492
2026-05-29 06:45:48,946 [root] DEBUG: 13492: caller_dispatch: Added region at 0x00007FF6706B0000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF6706B12F2, thread 13496).
2026-05-29 06:45:48,947 [root] DEBUG: 13492: YaraScan: Scanning 0x00007FF6706B0000, size 0x8026
2026-05-29 06:45:48,949 [root] DEBUG: 13492: ProcessImageBase: Main module image at 0x00007FF6706B0000 unmodified (entropy change 0.000000e+00)
2026-05-29 06:45:48,951 [root] DEBUG: 13492: DLL loaded at 0x00007FFF55510000: C:\Windows\SYSTEM32\kernel.appcore (0x12000 bytes).
2026-05-29 06:45:48,952 [root] DEBUG: 13492: DLL loaded at 0x00007FFF57EF0000: C:\Windows\System32\bcryptPrimitives (0x82000 bytes).
2026-05-29 06:45:48,955 [root] DEBUG: 13492: DLL loaded at 0x00007FFF58B30000: C:\Windows\System32\clbcatq (0xa9000 bytes).
2026-05-29 06:45:48,968 [root] DEBUG: 13492: DLL loaded at 0x00007FFF54FC0000: C:\Windows\system32\uxtheme (0x9e000 bytes).
2026-05-29 06:45:48,982 [root] DEBUG: 13492: DLL loaded at 0x00007FFF58070000: C:\Windows\System32\shcore (0xad000 bytes).
2026-05-29 06:45:48,982 [root] DEBUG: 13492: DLL loaded at 0x00007FFF432B0000: C:\Windows\System32\thumbcache (0x66000 bytes).
2026-05-29 06:45:48,988 [root] DEBUG: 13492: DLL loaded at 0x00007FFF52860000: C:\Windows\system32\propsys (0xf6000 bytes).
2026-05-29 06:45:54,043 [root] INFO: Process with pid 13492 has terminated
2026-05-29 06:45:54,044 [root] DEBUG: 13492: NtTerminateProcess hook: Attempting to dump process 13492
2026-05-29 06:45:54,045 [root] DEBUG: 13492: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:46:22,371 [root] DEBUG: 4104: CreateProcessHandler: Injection info set for new process 14232: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe, ImageBase: 0x00007FF7F5380000
2026-05-29 06:46:22,372 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 14232
2026-05-29 06:46:22,373 [root] DEBUG: 4104: ProcessMessage: Skipping monitoring process 14232
2026-05-29 06:46:44,435 [root] DEBUG: 12224: NtTerminateProcess hook: Attempting to dump process 12224
2026-05-29 06:46:44,436 [root] DEBUG: 12224: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:46:44,438 [root] INFO: Process with pid 12224 has terminated
2026-05-29 06:47:22,988 [root] INFO: Added new file to list with pid 9388 and path C:\ProgramData\Microsoft\Windows\WER\Temp\a6e4fa08-0880-4e40-b09b-bb389c339c38
2026-05-29 06:47:22,989 [root] DEBUG: 9388: NtTerminateProcess hook: Attempting to dump process 9388
2026-05-29 06:47:22,990 [root] DEBUG: 9388: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:47:22,999 [root] INFO: Process with pid 9388 has terminated
2026-05-29 06:47:42,838 [root] INFO: Analysis timeout hit, terminating analysis
2026-05-29 06:47:42,839 [lib.api.process] INFO: Terminate event set for process 4104
2026-05-29 06:47:42,840 [root] DEBUG: 4104: Terminate Event: Attempting to dump process 4104
2026-05-29 06:47:42,844 [root] DEBUG: 4104: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:47:42,866 [lib.api.process] INFO: Termination confirmed for process 4104
2026-05-29 06:47:42,867 [root] INFO: Terminate event set for process 4104
2026-05-29 06:47:42,866 [root] DEBUG: 4104: Terminate Event: monitor shutdown complete for process 4104
2026-05-29 06:47:42,868 [lib.api.process] INFO: Terminate event set for process 832
2026-05-29 06:47:42,868 [root] DEBUG: 832: Terminate Event: Attempting to dump process 832
2026-05-29 06:47:42,870 [root] DEBUG: 832: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:47:42,872 [lib.api.process] INFO: Termination confirmed for process 832
2026-05-29 06:47:42,872 [root] INFO: Terminate event set for process 832
2026-05-29 06:47:42,873 [root] DEBUG: 832: Terminate Event: monitor shutdown complete for process 832
2026-05-29 06:47:42,874 [lib.api.process] INFO: Terminate event set for process 676
2026-05-29 06:47:42,875 [root] DEBUG: 676: Terminate Event: Attempting to dump process 676
2026-05-29 06:47:42,877 [root] DEBUG: 676: DoProcessDump: Skipping process dump as code is identical on disk.
2026-05-29 06:47:42,879 [lib.api.process] INFO: Termination confirmed for process 676
2026-05-29 06:47:42,880 [root] INFO: Terminate event set for process 676
2026-05-29 06:47:42,880 [root] DEBUG: 676: Terminate Event: monitor shutdown complete for process 676
2026-05-29 06:47:42,880 [root] INFO: Created shutdown mutex
2026-05-29 06:47:43,884 [root] INFO: Shutting down package
2026-05-29 06:47:43,885 [root] INFO: Stopping auxiliary modules
2026-05-29 06:47:43,886 [root] INFO: Stopping auxiliary module: Browser
2026-05-29 06:47:43,886 [root] INFO: Stopping auxiliary module: Human
2026-05-29 06:47:43,887 [root] INFO: Stopping auxiliary module: Screenshots
2026-05-29 06:47:43,887 [root] INFO: Finishing auxiliary modules
2026-05-29 06:47:43,887 [root] INFO: Shutting down pipe server and dumping dropped files
2026-05-29 06:47:43,896 [lib.common.results] INFO: Uploading file C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log to files\a9dce6cfa04718d830d0b771fec562178730bed2ef59c79fede912a7dd96fef7; Size is 692816; Max size: 100000000
2026-05-29 06:47:43,900 [root] WARNING: File at path c:\programdata\microsoft\windows\wer\temp\werc3de.tmp.csv does not exist, skipping
2026-05-29 06:47:43,901 [root] WARNING: File at path c:\programdata\microsoft\windows\wer\temp\werc41d.tmp.txt does not exist, skipping
2026-05-29 06:47:43,901 [root] WARNING: File at path c:\programdata\microsoft\windows\wer\temp\a6e4fa08-0880-4e40-b09b-bb389c339c38 does not exist, skipping
2026-05-29 06:47:43,901 [root] WARNING: Folder at path "C:\gZRInK\debugger" does not exist, skipping
2026-05-29 06:47:43,902 [root] WARNING: Folder at path "C:\gZRInK\tlsdump" does not exist, skipping
2026-05-29 06:47:44,062 [root] WARNING: Monitor injection attempted but failed for process 9528
2026-05-29 06:47:44,062 [root] WARNING: Monitor injection attempted but failed for process 9452
2026-05-29 06:47:44,063 [root] WARNING: Monitor injection attempted but failed for process 10160
2026-05-29 06:47:44,063 [root] WARNING: Monitor injection attempted but failed for process 8272
2026-05-29 06:47:44,064 [root] WARNING: Monitor injection attempted but failed for process 9120
2026-05-29 06:47:44,064 [root] WARNING: Monitor injection attempted but failed for process 12232
2026-05-29 06:47:44,065 [root] WARNING: Monitor injection attempted but failed for process 10244
2026-05-29 06:47:44,065 [root] INFO: Analysis completed

Process Log

Pre-Script Log

During-Script Log

Machine Information

Name	Label	Manager	Started On	Shutdown On	Route
cuckoo1	cuckoo1	KVM	2026-05-29 06:44:05	2026-05-29 06:47:46	`none`

URL Details

Processing 5.09s

1.832s UrlAnalysis
1.49s CAPE
1.246s NetworkAnalysis
0.508s BehaviorAnalysis
0.014s AnalysisInfo
0.001s Debug

Signatures 0.90s

0.313s antiav_detectreg
0.109s infostealer_ftp
0.101s territorial_disputes_sigs
0.067s antianalysis_detectreg
0.06s infostealer_im
0.036s antivm_vbox_keys
0.024s antivm_vmware_keys
0.017s antivm_parallels_keys
0.017s antivm_xen_keys
0.013s antivm_generic_diskreg
0.012s antivm_vpc_keys
0.012s infostealer_mail
0.011s uses_windows_utilities
0.01s suspicious_command_tools
0.008s masquerade_process_name
0.006s antiav_detectfile
0.006s antivm_bochs_keys
0.006s antivm_hyperv_keys
0.006s odbcconf_bypass
0.006s bypass_firewall
0.004s antivm_generic_bios
0.004s ransomware_files
0.003s antianalysis_detectfile
0.003s ketrican_regkeys
0.003s disables_windows_defender_logging
0.003s removes_windows_defender_contextmenu
0.003s infostealer_bitcoin
0.003s network_dns_url_shortener
0.003s suspicious_tld
0.003s recon_fingerprint
0.002s network_dyndns
0.002s antivm_vbox_files
0.002s browser_security
0.002s disables_browser_warn
0.002s ransomware_extensions_known
0.001s network_open_proxy
0.001s network_torgateway
0.001s recon_checkip
0.001s accesses_netlogon_regkey
0.001s antidebug_devices
0.001s antivm_vbox_devices
0.001s antivm_vmware_files
0.001s browser_addon
0.001s checks_uac_status
0.001s uac_bypass_cmstpcom
0.001s registry_lsa_secrets_access
0.001s disables_backups
0.001s disables_system_restore
0.001s disables_windows_defender
0.001s folder_enumeration
0.001s discover_registry_mount_points
0.001s modify_security_center_warnings
0.001s modify_uac_prompt
0.001s accesses_office_username
0.001s packer_armadillo_regkey
0.001s stealth_hiddenreg
0.001s tampers_etw

Reporting 0.03s

0.033s JsonDump

Signatures

Checks available memory

Attempts to connect to a dead IP:Port (2 unique times)

IP: 150.171.22.17:443

IP: 74.178.76.44:443

Queries the keyboard layout

Queries the computer locale (possible geofencing)

A file was accessed within the Public folder.

file: C:\Users\Public\Desktop\Microsoft Edge.lnk

file: C:\Users\Public\Desktop

file: C:\Users\Public\Desktop\Steam.lnk

file: C:\Users\Public\

file: C:\Users\Public\Desktop\Google Chrome.lnk

file: C:\Users\Public\Desktop\desktop.ini

file: C:\Users\Public\Desktop\

file: C:\Users\Public\desktop.ini

SetUnhandledExceptionFilter detected (possible anti-debug)

At least one process apparently crashed during execution

Possible date expiration check, exits too soon after checking local time

process: MicrosoftEdgeUpdate.exe, PID 5932

Checks system language via registry key (possible geofencing)

regkey: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-AU

regkey: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-AU

Queries process token information to check for Administrator privileges or UAC elevation status

Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software

behavioral_fips_reconnaissance: ["SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "svchost.exe (PID: 9388) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "SecurityHealthHost.exe (PID: 11836) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'", "MicrosoftEdgeUpdate.exe (PID: 11132) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'", "dllhost.exe (PID: 13492) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'", "MicrosoftEdgeUpdate.exe (PID: 5932) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'"]

Queries the mount points and then resolves volume paths to enumerate storage devices

A DLL was loaded from a suspicious directory

suspicious_dll_load: Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking

Registers a vectored exception handler (VEH), possibly to hijack execution flow

Creates a process in a suspended state, likely for injection

Resumed a thread in another process

thread_resumed: Process svchost.exe with process ID 832 resumed a thread in another process with the process ID 9452

thread_resumed: Process services.exe with process ID 676 resumed a thread in another process with the process ID 5932

Terminates another process

process: svchost.exe

Queries registry mount points to identify historical or connected removable/network drives

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Data

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Generation

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Generation

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Data

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Generation

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\

mount_point_key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Data

Resolves a suspicious Top Level Domain (TLD)

domain: latency.discord.media

Uses Windows utilities for basic functionality

command: "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4

Tries to unhook or modify Windows functions monitored by CAPE

unhook: function_name: CryptHashSessionKey, type: restored

unhook: function_name: CryptGenRandom, type: restored

unhook: function_name: CryptExportKey, type: restored

unhook: function_name: NCryptImportKey, type: restored

unhook: function_name: CryptGenKey, type: restored

unhook: function_name: CommandLineToArgvW, type: restored

unhook: function_name: CryptAcquireContextW, type: restored

unhook: function_name: CryptAcquireContextA, type: restored

unhook: function_name: SslEncryptPacket, type: restored

unhook: function_name: CryptEncrypt, type: restored

unhook: function_name: CryptEnumProvidersA, type: restored

unhook: function_name: CryptHashData, type: restored

unhook: function_name: SslDecryptPacket, type: restored

unhook: function_name: CryptCreateHash, type: restored

unhook: function_name: CryptEnumProvidersW, type: restored

unhook: function_name: NCryptDecrypt, type: restored

unhook: function_name: NCryptEncrypt, type: restored

unhook: function_name: CryptDecrypt, type: restored

unhook: function_name: CryptImportKey, type: restored

Queries the Volume Serial Number or Physical Hardware ID, possibly for anti-sandbox, victim profiling or environmental keying

Checks the system manufacturer, likely for anti-virtualization

Process: MicrosoftEdgeUpdate.exe (5932)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Process: MicrosoftEdgeUpdate.exe (5932)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Process: MicrosoftEdgeUpdate.exe (5932)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Process: MicrosoftEdgeUpdate.exe (5932)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Process: MicrosoftEdgeUpdate.exe (5932)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Process: MicrosoftEdgeUpdate.exe (5932)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Process: MicrosoftEdgeUpdate.exe (5932)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Process: MicrosoftEdgeUpdate.exe (5932)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
Process: MicrosoftEdgeUpdate.exe (11132)
registry		HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer

Uses suspicious IO control codes, indicative of disk enumeration or a bootkit/wiper

Inter-process synchronization via mutexes, possibly for routing local C2 traffic or injection

ipc_mutex_synchronization: [{'mutex_name': '__OMADM_NAMED_MUTEX__', 'creator_process': 'MicrosoftEdgeUpdate.exe (PID: 5932)', 'accessor_process': 'MicrosoftEdgeUpdate.exe (PID: 11132)'}, {'mutex_name': '_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log', 'creator_process': 'MicrosoftEdgeUpdate.exe (PID: 5932)', 'accessor_process': 'MicrosoftEdgeUpdate.exe (PID: 11132)'}, {'mutex_name': 'Global\\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}', 'creator_process': 'MicrosoftEdgeUpdate.exe (PID: 5932)', 'accessor_process': 'MicrosoftEdgeUpdate.exe (PID: 11132)'}, {'mutex_name': 'Global\\EdgeUpdate{921D73A1-67B6-4E73-81EA-8A162D92D990}', 'creator_process': 'MicrosoftEdgeUpdate.exe (PID: 5932)', 'accessor_process': 'MicrosoftEdgeUpdate.exe (PID: 11132)'}]

Forces a created process to be the child of an unrelated process

created_process: Process C:\Windows\system32\WerFault.exe -u -p 8756 -s 284 has spoofed parent process with real parent process svchost.exe

Seek in progress...

00:00 / 00:00

Hosts

Direct	IP	Country Name	ASN
Y	72.153.5.62 [VT]	unknown	-
Y	72.153.5.96 [VT]	unknown	-
Y	72.153.5.141 [VT]	unknown	-
Y	23.202.166.56 [VT]	unknown	-
Y	150.171.109.19 [VT]	unknown	-
Y	104.29.148.135 [VT]	unknown	-
Y	104.29.138.227 [VT]	unknown	-
Y	104.29.138.199 [VT]	unknown	-
Y	104.29.139.137 [VT]	unknown	-
Y	104.29.139.152 [VT]	unknown	-
Y	104.29.143.150 [VT]	unknown	-
Y	104.29.140.158 [VT]	unknown	-
Y	104.29.140.174 [VT]	unknown	-
Y	104.29.140.170 [VT]	unknown	-
Y	104.29.141.15 [VT]	unknown	-
Y	104.29.132.82 [VT]	unknown	-
Y	104.29.132.119 [VT]	unknown	-
Y	104.29.157.219 [VT]	unknown	-
Y	104.29.136.163 [VT]	unknown	-
Y	104.29.132.178 [VT]	unknown	-
Y	104.29.140.188 [VT]	unknown	-
Y	104.29.141.148 [VT]	unknown	-
Y	104.29.142.90 [VT]	unknown	-
Y	104.29.142.1 [VT]	unknown	-
Y	104.29.141.192 [VT]	unknown	-
Y	104.29.149.132 [VT]	unknown	-
Y	104.29.149.149 [VT]	unknown	-
Y	104.29.149.134 [VT]	unknown	-
Y	104.29.149.152 [VT]	unknown	-
Y	104.29.149.137 [VT]	unknown	-
N	162.159.130.235 [VT]	unknown	-
Y	23.211.129.205 [VT]	unknown	-
Y	146.75.119.82 [VT]	unknown	-
N	199.232.211.52 [VT]	unknown	-
N	23.209.183.106 [VT]	unknown	-
N	205.196.6.133 [VT]	unknown	-
Y	162.254.195.75 [VT]	unknown	-
Y	162.254.195.69 [VT]	unknown	-
Y	103.10.125.22 [VT]	unknown	-
N	23.216.106.59 [VT]	unknown	-
Y	23.56.110.169 [VT]	unknown	-
N	162.159.128.235 [VT]	unknown	-
N	185.247.139.200 [VT]	unknown	-
N	162.159.136.232 [VT]	unknown	-
N	162.159.135.234 [VT]	unknown	-
N	162.159.135.233 [VT]	unknown	-
N	162.159.133.233 [VT]	unknown	-
N	142.250.195.227 [VT]	unknown	-
Y	40.126.14.161 [VT]	unknown	-
Y	104.115.81.8 [VT]	unknown	-
Y	172.172.255.218 [VT]	unknown	-
N	149.135.84.155 [VT]	unknown	-
N	199.232.215.52 [VT]	unknown	-
Y	103.10.125.23 [VT]	unknown	-

DNS

Name	Response	Post-Analysis Lookup
api.steampowered.com [VT]	A 23.216.106.59 [VT]	23.216.106.59 [VT]
ipv6check-udp.steamserver.net [VT]	CNAME udp.ipv6check.akadns.net [VT] AAAA 2404:3fc0:1:102::670a:7d36 [VT] AAAA 2404:3fc0:1:102::670a:7d37 [VT] AAAA 2404:3fc0:1:100::670a:7d06 [VT] AAAA 2404:3fc0:1:100::42 [VT] AAAA 2404:3fc0:1:102::670a:7d38 [VT] CNAME syd.udp.ipv6check.akadns.net [VT] AAAA 2404:3fc0:1:100::670a:7d08 [VT] AAAA 2404:3fc0:1:102::670a:7d35 [VT] AAAA 2404:3fc0:1:100::32 [VT]
ipv6check-http.steamserver.net [VT]	CNAME http.ipv6check.akadns.net [VT] CNAME syd.http.ipv6check.akadns.net [VT]
steamconnecttest.com [VT]	A 149.135.84.155 [VT] A 149.135.84.160 [VT]	23.56.110.24 [VT]
c.pki.goog [VT]	A 142.250.195.227 [VT] CNAME pki-goog.l.google.com [VT]	142.250.195.163 [VT]
discordapp.com [VT]	A 162.159.135.233 [VT] A 162.159.134.233 [VT] A 162.159.133.233 [VT] A 162.159.129.233 [VT] A 162.159.130.233 [VT]	162.159.129.233 [VT]
gateway-us-east1-c.discord.gg [VT]	A 162.159.130.234 [VT] A 162.159.134.234 [VT] A 162.159.135.234 [VT] A 162.159.133.234 [VT] A 162.159.136.234 [VT]	162.159.130.234 [VT]
badoomovies.com [VT]	A 185.247.139.200 [VT]	185.247.139.200 [VT]
status.discord.com [VT]	A 162.159.128.233 [VT] A 162.159.138.232 [VT] A 162.159.137.232 [VT] A 162.159.135.232 [VT] A 162.159.136.232 [VT]	162.159.136.232 [VT]
cdn.discordapp.com [VT]		162.159.133.233 [VT]
updates.discord.com [VT]		162.159.138.232 [VT]
dns.google [VT]	A 8.8.4.4 [VT] A 8.8.8.8 [VT]	8.8.4.4 [VT]
cmp2-sea1.steamserver.net [VT]	A 205.196.6.133 [VT]	205.196.6.133 [VT]
p2p-syd1.discovery.steamserver.net [VT]	A 103.10.125.24 [VT] A 103.10.125.42 [VT]	103.10.125.42 [VT]
clientconfig.akamai.steamstatic.com [VT]	A 23.209.183.106 [VT] A 23.209.183.176 [VT]	23.211.125.112 [VT]
shared.steamstatic.com [VT]	A 199.232.215.52 [VT] A 199.232.211.52 [VT] CNAME shared.valve.map.fastly.net [VT]	199.232.211.52 [VT]
latency.discord.media [VT]	A 162.159.130.235 [VT] A 162.159.129.235 [VT] A 162.159.138.234 [VT] A 162.159.137.234 [VT] A 162.159.128.235 [VT]	162.159.137.234 [VT]
disabled.invalid [VT]	NXDOMAIN

Summary

Accessed Files Modified Files Deleted Files Registry Keys Read Registry Keys Modified Registry Keys Deleted Registry Keys Executed Commands Mutexes Started Services

C:\
C:\Users\desktop.ini
C:\Users
C:\Users\admin
C:\Users\admin\AppData
C:\Users\admin\AppData\Roaming
C:\Users\admin\AppData\Roaming\Microsoft\desktop.ini
C:\Users\admin\AppData\Roaming\Microsoft
C:\Users\admin\AppData\Roaming\Microsoft\Windows
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned
C:\ProgramData\Microsoft\Windows\Start Menu\Programs
C:\ProgramData\Microsoft\Windows\Start Menu
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu
C:\Users\admin\AppData\Local\Microsoft\Windows\Burn
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts
C:\Users\Public\Desktop
C:\Users\admin\Desktop
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg
C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg
C:\Windows\
C:\Windows\System32\
\Device\Bam
C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
C:\Windows\apppatch\sysmain.sdb
C:\Program Files (x86)\Microsoft\
C:\Program Files (x86)\Microsoft\Edge\Application\
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
C:\Users\admin\AppData\Local
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
C:\program files (x86)\microsoft\Edge\application\msedge.exe
C:\program files (x86)\microsoft\Edge\SystemResources\msedge.exe.mun
C:\Users\admin\Desktop\desktop.ini
C:\Users\Public\desktop.ini
C:\Users\Public
C:\Users\Public\Desktop\desktop.ini
C:\Windows\System32\twinui.pcshell.dll
C:\Windows\System32\SecurityHealthSSO.dll
\??\Volume{528C102F-0000-0000-0000-300300000000}
\Device\HarddiskVolume2\\xe68\x02
\??\MountPointManager
C:\Windows\System32\services.exe
C:\Windows\System32\en-US\services.exe.mui
C:\Windows\explorer.exe
C:\Windows\System32\d3d10warp.dll
C:\Windows\Fonts\seguisb.ttf
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\resources.pri
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\pris\
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\
C:\Windows\rescache\_merged\2716907977\3245838983.pri
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\pris\resources.en-US.pri
::\
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
\??\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
\??\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer
C:\Windows\System32\imageres.dll
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
C:\Windows\System32\en-US\imageres.dll.mui
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch
C:\Windows\System32\SystemResources\imageres.dll.mui.mun
C:\Windows\SystemResources\imageres.dll.mun
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
C:\Program Files\desktop.ini
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Discord Inc\Discord.lnk
C:\program files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
C:\Program Files
C:\Program Files\WindowsApps
C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
C:\Users\Public\Desktop\Google Chrome.lnk
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
C:\Users\Public\Desktop\Microsoft Edge.lnk
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Users\Public\Desktop\
C:\Users\Public\
C:\Users\admin\AppData\Local\Discord\app.ico
C:\Users\
C:\Users\Public\Desktop\Steam.lnk
C:\Users\admin\Desktop\Discord.lnk
C:\Program Files (x86)\Steam\Steam.exe.Config
C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\_resources
C:\Program Files\WindowsApps\PythonSoftwareFoundation.PythonManager_26.2.240.0_x64__3847v3x7pw1km\_resources\
C:\Program Files\WindowsApps\
C:\Program Files\
C:
C:\Users\admin\AppData\Local\Discord\Update.exe
C:\Users\admin\AppData\Local\Discord\Update.exe.Config
C:\program files (x86)\Steam\steam.exe
C:\program files (x86)\SystemResources\steam.exe.mun
C:\Users\admin\Desktop\
C:\Users\admin\Desktop\Gmail.url
C:\Users\admin\
C:\Users\admin\Desktop\WhatsApp Web.url
C:\program files\Google\Chrome\application\chrome.exe
C:\program files\Google\Chrome\SystemResources\chrome.exe.mun
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
C:\Windows\System32\usp10.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
\??\pipe\crashpad_4104_VNIRRYNIERXILDVP
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\148.0.3967.83\msedge.dll
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge.dll
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\icudtl.dat
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\v8_context_snapshot.bin
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge_100_percent.pak
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\msedge_200_percent.pak
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\Locales
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\Locales\en-US.pak
C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\resources.pak
C:\Windows\System32\policymanager.dll
C:\Program Files (x86)\Microsoft\Edge\Application\msvcp110_win.dll
C:\Windows\System32\msvcp110_win.dll
C:\Windows\System32\usermgrcli.dll
C:\Windows\System32\capauthz.dll
C:\Program Files (x86)\Microsoft\Edge\Application\MSASN1.dll
C:\Windows\System32\msasn1.dll
C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep
C:\Windows\System32\en-US\KERNELBASE.dll.mui
C:\Windows\SysWOW64\propsys.dll
C:\Windows\System32\propsys.dll
C:\Users\admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe
C:\Users\admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\
C:\Users\admin\AppData\Local\Packages
C:\Users\admin\AppData\Local\Packages\
C:\Users\admin\AppData\Local\
C:\Users\admin\AppData\
C:\Users\admin\AppData\Local\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\ToastCollectionIcons\*
\??\PhysicalDrive0
C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.ContentDeliveryManager_10.0.19041.3636_neutral_neutral_cw5n1h2txyewy\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep
C:\Windows\System32\SecurityHealthHost.exe
C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep
C:\ProgramData\Microsoft\Windows\AppRepository\Packages\Microsoft.Windows.Search_1.14.10.19041_neutral_neutral_cw5n1h2txyewy\S-1-5-18.pckgdep
C:\Windows\ServiceProfiles\
C:\Windows\System32\windows.storage.dll
C:\Windows\System32\wldp.dll
C:\Program Files (x86)
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
C:\Program Files (x86)\Microsoft\EdgeUpdate\
C:\Program Files (x86)\Microsoft\EdgeUpdate\msedgeupdate.dll
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.233.3\msedgeupdate.dll
\??\PIPE\wkssvc
C:\Windows\System32\omadmapi.dll
C:\Windows\System32\powrprof.dll
C:\Windows\System32\cryptsp.dll
C:\Windows\System32\DMCmnUtils.dll
C:\Windows\System32\ncrypt.dll
C:\Windows\System32\tbs.dll
C:\Windows\System32\umpdc.dll
C:\Windows\System32\ntasn1.dll
C:\Windows\System32\profapi.dll
C:\Windows\sysnative\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead
C:\Windows\sysnative\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\*
C:\Windows\sysnative\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\*
C:\Windows\sysnative\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\*
C:\MicrosoftEdgeUpdate.ini
C:\ProgramData\Microsoft\EdgeUpdate\Log
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.233.3
C:\Windows\System32\kernel.appcore.dll
\Device\CNG
C:\Program Files (x86)\Microsoft
C:\Program Files (x86)\Microsoft\EdgeUpdate
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\*
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\*
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\148.0.3967.83\*
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\*
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\148.0.3967.83\*
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\*
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.233.3\*
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\*.*
C:\Windows\System32\userenv.dll
C:\Windows\Temp
C:\Users\admin\AppData\Local\Temp
C:\Windows
C:\Windows\System32
C:\Windows\SysWOW64\IntegratedServicesRegionPolicySet.json
C:\Windows\System32\IntegratedServicesRegionPolicySet.json
\Device\DeviceApi\CMApi
C:\Windows\sysnative\propsys.dll
C:\Windows\System32\en-US\windows.storage.dll.mui
C:\Windows\sysnative\en-US\windows.storage.dll.mui
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\*.*
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini\desktop.ini
C:\Windows\System32\en-US\PROPSYS.dll.mui
C:\Windows\sysnative\en-US\PROPSYS.dll.mui
C:\Windows\System32\linkinfo.dll
C:\Program Files (x86)\desktop.ini
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\*.*
C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\*
C:\Windows\System32\license.rtf
\??\{4C572733-2FBA-4346-9601-F86DBA666EF2}
C:\Windows\System32\winsta.dll
\Device\RasAcd
C:\Windows\System32\mswsock.dll
C:\Windows\System32\en-US\mswsock.dll.mui
C:\Windows\sysnative\en-US\mswsock.dll.mui
C:\Windows\System32\wshqos.dll
C:\Windows\System32\en-US\wshqos.dll.mui
C:\Windows\sysnative\en-US\wshqos.dll.mui
C:\Windows\System32\dnsapi.dll
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\en-US\CRYPT32.dll.mui
C:\Windows\sysnative\en-US\CRYPT32.dll.mui
C:\Windows\System32\dpapi.dll
C:\Windows\System32\MsMpLics.dll
C:\ProgramData\Microsoft\Windows\WER
C:\ProgramData\Microsoft\Windows\WER\ReportQueue
C:\ProgramData\Microsoft\Windows\WER\Temp
C:\ProgramData\Microsoft\Windows
C:\ProgramData\Microsoft\Windows\WER\Temp\a6e4fa08-0880-4e40-b09b-bb389c339c38
C:\ProgramData\Microsoft\Windows\WER\ReportArchive
C:\ProgramData\Microsoft\Windows\WER\Temp\28c4bba8-9b4d-4ecd-9f53-ce7a8d27701a
C:\Windows\System32\Faultrep.dll
C:\Windows\System32\dbghelp.dll
C:\Windows\System32\dbgcore.dll
C:\Windows\System32\wer.dll
C:\ProgramData\Microsoft\Windows\WER\Temp\0d5844f8-11cb-4a90-804d-9eeed0bd5515
C:\ProgramData\Microsoft\Windows\WER\Temp\c82e364e-9619-4e20-9837-f3d32208cbe0
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3DE.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3DE.tmp.csv
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC41D.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC41D.tmp.txt
C:\Windows\System32\rpcss.dll
C:\Windows\System32\wtsapi32.dll
C:\Windows\System32\IPHLPAPI.DLL
\??\Nsi
C:\Windows\System32\dusmapi.dll
C:\ProgramData\Microsoft\Windows\OneSettings
C:\ProgramData\Microsoft\Windows\OneSettings\config.json
C:\ProgramData\Microsoft\Windows\Models
C:\ProgramData\Microsoft\Windows\OneSettings\CTAC.json
C:\Windows\System32\en-US\Windows.Web.dll.mui
\??\TPM

C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db
C:\Users\admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db
\??\pipe\crashpad_4104_VNIRRYNIERXILDVP
\??\PIPE\wkssvc
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
\Device\RasAcd
C:\ProgramData\Microsoft\Windows\WER\Temp
C:\ProgramData\Microsoft\Windows\WER\Temp\a6e4fa08-0880-4e40-b09b-bb389c339c38
C:\ProgramData\Microsoft\Windows\WER\ReportQueue
C:\ProgramData\Microsoft\Windows\WER\Temp\28c4bba8-9b4d-4ecd-9f53-ce7a8d27701a
C:\ProgramData\Microsoft\Windows\WER\ReportArchive
C:\ProgramData\Microsoft\Windows\WER\Temp\0d5844f8-11cb-4a90-804d-9eeed0bd5515
C:\ProgramData\Microsoft\Windows\WER\Temp\c82e364e-9619-4e20-9837-f3d32208cbe0
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3DE.tmp.csv
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC41D.tmp.txt
\??\TPM

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000000.db
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3DE.tmp
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC41D.tmp

HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\channel
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\ap
HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\name
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-AU
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-AU
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Sorting\Ids
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-AU
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\OEM
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\OEM\DeviceForm
HKEY_CURRENT_USER
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DisplayVersion
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32
HKEY_CURRENT_USER\Software\Classes
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsRuntime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\Diagnosis
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateOnHostFlags
HKEY_CURRENT_USER\Software\Classes\Interface\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{00000035-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{00000035-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000035-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000035-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}
HKEY_LOCAL_MACHINE\Software\Classes\Interface\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}
HKEY_CURRENT_USER\Software\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocServer32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}
HKEY_CURRENT_USER\Software\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocServer32\ThreadingModel
HKEY_CURRENT_USER\Software\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\TreatAs
HKEY_CURRENT_USER\Software\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\AppID
HKEY_CURRENT_USER\Software\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7ab93c52-0e48-4750-ba9d-1a4113981847}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7ab93c52-0e48-4750-ba9d-1a4113981847}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5caddc63-01d3-4c97-986f-0533483fee14}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\Classes\Interface\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3bc3d253-2f31-4092-9129-8ad5abf067da}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3bc3d253-2f31-4092-9129-8ad5abf067da}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\PolicyType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\MergeAlgorithm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\RegKeyPathRedirectMapped
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\grouppolicypath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\grouppolicyismultisz
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\grouppolicymultiszSeparatorChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\Value
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppPrivacy
HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\Device\Privacy
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\PolicyType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocServer32
HKEY_CURRENT_USER\Software\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\grouppolicypath
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Containers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Containers\WaitForRestore
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\Value
HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\PolicyType
HKEY_CURRENT_USER\Software\Classes\Interface\{DF8E9480-CA73-448E-B8F0-DA000F581428}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF8E9480-CA73-448E-B8F0-DA000F581428}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\MergeAlgorithm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\RegKeyPathRedirectMapped
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\RegKeyPathRedirect
HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\grouppolicyname
HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\grouppolicypath
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\grouppolicyismultisz
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\Value
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\MergeAlgorithm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\RegKeyPathRedirectMapped
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\grouppolicypath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\Value
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateInSharedBroker
HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ExePath
HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\IdentityType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ServerType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\Identity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ServiceName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ExplicitPsmActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\CustomAttributes
HKEY_CURRENT_USER\Software\Classes\Interface\{84103CCB-2FD7-4D6C-962E-5D8582B4C720}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}
HKEY_CURRENT_USER\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{DCAEE35A-508D-4419-9E56-50D658C2C812}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAEE35A-508D-4419-9E56-50D658C2C812}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\AppID
HKEY_CURRENT_USER\Software\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{5232F8EA-49C7-4840-BFBB-66E785689E88}
HKEY_CURRENT_USER\Software\Classes\Interface\{5232f8ea-49c7-4840-bfbb-66e785689e88}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5232f8ea-49c7-4840-bfbb-66e785689e88}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5232f8ea-49c7-4840-bfbb-66e785689e88}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\ActivationType
HKEY_CURRENT_USER\Software\Classes\Interface\{D6F5F569-D40D-407C-8989-88CAB42CFD14}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\Permissions
HKEY_CURRENT_USER\Software\Classes\Interface\{79AB57F6-43FE-487B-8A7F-99567200AE94}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79ab57f6-43fe-487b-8a7f-99567200ae94}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\Classes\Interface\{679C64B7-81AB-42C2-8819-C958767753F4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{679C64B7-81AB-42C2-8819-C958767753F4}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{679C64B7-81AB-42C2-8819-C958767753F4}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{195F5943-0C04-4EAB-B907-735817FDAC77}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{195f5943-0c04-4eab-b907-735817fdac77}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{195f5943-0c04-4eab-b907-735817fdac77}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{F655B052-348B-4AB0-947B-A7DAFA44D404}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F655B052-348B-4AB0-947B-A7DAFA44D404}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F655B052-348B-4AB0-947B-A7DAFA44D404}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{58058629-16A1-438A-90C8-7E954B3734B1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58058629-16A1-438A-90C8-7E954B3734B1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58058629-16A1-438A-90C8-7E954B3734B1}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityManager\CapAuthz
HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityManager\CapAuthz\HasRepaired
HKEY_CURRENT_USER\Software\Classes\Interface\{2A1821FE-179D-49BC-B79D-A527920D3665}
HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityManager\CapDBRedirect
HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\AppPackageType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\PackageSid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\ApplicationFlags
HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\Behavior
HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\grouppolicymultiszSeparatorChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\grouppolicyismultisz
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\grouppolicymultiszSeparatorChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\CapSids
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Appx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepositoryRoot
HKEY_LOCAL_MACHINE\Software\Microsoft\LanguageOverlay\OverlayPackages\en-US
HKEY_CURRENT_USER\Software\Classes\Interface\{C5543B33-5C73-4DC5-9211-24077D3B06C5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppModel\LimitedAccessFeatures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\LimitedAccessFeatures\com.microsoft.windows.taskbar.requestPinSecondaryTile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\LimitedAccessFeatures\com.microsoft.windows.taskbar.requestPinSecondaryTile\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\LimitedAccessFeatures\com.microsoft.windows.taskbar.requestPinSecondaryTile\Expiration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\Software\Microsoft\XAML
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\XAML\OneCoreTransformsEnabledByDefault
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ExePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\CommandLine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ServiceName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ExplicitPsmActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ActivatableClasses
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ServerType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\Identity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\ActivateInSharedBroker
HKEY_CURRENT_USER\Software\Classes\Interface\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}
HKEY_CURRENT_USER\Software\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InProcServer32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{350E1244-4575-45EE-8595-0AA8C6506FC7}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\Interface\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InProcServer32\ThreadingModel
HKEY_CURRENT_USER\Software\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\AppID
HKEY_CURRENT_USER\Software\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\Threading
HKEY_CURRENT_USER\Software\Classes\Interface\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\Classes\Interface\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\ActivateOnHostFlags
HKEY_CURRENT_USER\Software\Classes\Interface\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateOnHostFlags
HKEY_CURRENT_USER\Software\Classes\Interface\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\Classes\Interface\{D81E96F1-A89C-417E-9335-59531026309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{d81e96f1-a89c-417e-9335-59531026309d}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{d81e96f1-a89c-417e-9335-59531026309d}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\ProxyStubClsid32
HKEY_CURRENT_USER\Software\Classes\Interface\{9ED07B24-36FD-543B-948E-B01FE5814B49}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ed07b24-36fd-543b-948e-b01fe5814b49}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ed07b24-36fd-543b-948e-b01fe5814b49}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{EFE869FC-5841-55F1-AA56-82C7219AAA09}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{efe869fc-5841-55f1-aa56-82c7219aaa09}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{efe869fc-5841-55f1-aa56-82c7219aaa09}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivateOnHostFlags
HKEY_CURRENT_USER\Software\Classes\Interface\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}
HKEY_CURRENT_USER\Software\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InProcServer32\ThreadingModel
HKEY_CURRENT_USER\Software\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\AppID
HKEY_CURRENT_USER\Software\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivateOnHostFlags
HKEY_CURRENT_USER\Software\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateOnHostFlags
HKEY_CURRENT_USER\Software\Classes\Interface\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\AppModel\PinnableSurfaces
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\PinnableSurfaces\DefaultStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\Software\Microsoft\SecurityManager\AdminCapabilities
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\AdminCapabilities\shellExperience
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivateOnHostFlags
HKEY_USERS
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\PSR
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\PSR\WnfStateName
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3968686040-3210279463-847977608-1001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3968686040-3210279463-847977608-1001\ProfileImagePath
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\identity_helper.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SyncRootManager
HKEY_CLASSES_ROOT\Directory
HKEY_CURRENT_USER\Software\Classes\Directory\ShellEx\LibraryDescriptionHandler
HKEY_LOCAL_MACHINE\Software\Classes\Directory\ShellEx\LibraryDescriptionHandler
HKEY_CLASSES_ROOT\Folder
HKEY_CURRENT_USER\Software\Classes\Folder\ShellEx\LibraryDescriptionHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\LibraryDescriptionHandler
HKEY_CLASSES_ROOT\AllFilesystemObjects
HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\LibraryDescriptionHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\LibraryDescriptionHandler
HKEY_CURRENT_USER\Software\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowStatusBar
HKEY_CURRENT_USER\Software\Classes\Directory\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\IconHandler
HKEY_CURRENT_USER\Software\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_CURRENT_USER\Software\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_CURRENT_USER\Software\Classes\Directory\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\Clsid
HKEY_CURRENT_USER\Software\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_CURRENT_USER\Software\Classes\Directory\AlwaysShowExt
HKEY_CURRENT_USER\Software\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PropertyBag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PropertyBag
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PropertyBag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PropertyBag
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PropertyBag
HKEY_CURRENT_USER\Software\Classes\Directory\ShellEx\PropertyHandler
HKEY_LOCAL_MACHINE\Software\Classes\Directory\ShellEx\PropertyHandler
HKEY_CURRENT_USER\Software\Classes\Folder\ShellEx\PropertyHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\PropertyHandler
HKEY_CURRENT_USER\Software\Classes\AllFilesystemObjects\ShellEx\PropertyHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\PropertyHandler
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\pv
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdateDev\
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc
HKEY_LOCAL_MACHINE\Software\Microsoft\Provisioning\OMADM\Accounts
HKEY_USERS\.DEFAULT\Software\Microsoft\Provisioning\OMADM\Accounts
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MiniNT
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\My\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\My
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\MY\CTLs
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\My\PhysicalStores
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\My
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Copilot
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EdgeUpdate\
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\edgeupdate_service_name
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\edgeupdate
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\edgeupdate\Alias
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\Cryptography\Configuration
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\AllowDevelopmentWithoutDevLicense
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseActivationAuthenticationLevel
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\Elevation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge
HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\Clients\
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\AdminCapabilities\packageContents
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\0
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_LOCAL_MACHINE\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\DefaultUserEnviroment
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Environment
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Volatile Environment
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Volatile Environment\0
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PropertyBag
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{A520A1A4-1780-4FF6-BD18-167343C5AF16}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000035-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000035-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000035-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\GipActivityBypass
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\ProxyStubClsid32\(Default)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\MicrosoftEdgeUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer
HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Windows\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PropertyBag
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\0
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PropertyBag
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\CommandLine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ActivatableClasses
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{89BC3F49-F8D9-5103-BA13-DE497E609167}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.json
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\PropertySystem\PropertyHandlers\.json
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\OpenWithProgids
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.json\OpenWithProgids
HKEY_LOCAL_MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.fileTypeAssociation\.json
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\ShellEx\PropertyHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\ShellEx\PropertyHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.json
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\PerceivedType
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\ShellEx\PropertyHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\SystemIndexNormalization
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.json
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NeverShowExt
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\name
HKEY_USERS\
HKEY_USERS\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-19\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-19\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-20\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-20\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-18\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\lang
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\tttoken
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\client
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\oobeinstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\updatecount
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\ShellFolder
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NormalizeLinkNetPidls
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\UseLocalMachineSoftwareClassesWhenImpersonating
HKEY_LOCAL_MACHINE\SOFTWARE\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\lastrun
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\InactivityBadgeApplied
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\freseen
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\freseenversion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\usagestats
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\name
HKEY_USERS\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-19\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-19\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-20\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-20\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-18\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\lang
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\tttoken
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\client
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\oobeinstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\updatecount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\name
HKEY_USERS\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\.DEFAULT\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-19\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-19\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-20\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-20\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-18\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\lang
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientStateMedium\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\tttoken
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\client
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\oobeinstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\updatecount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\OemInstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\CurrentState
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\2\ServiceName
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\uid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid\ABshOnzU
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid-create-time
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid-num-rotations
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\UBR
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsSelfHost\Applicability
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsSelfHost\Applicability\EnablePreviewBuilds
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemInformation
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{A520A1A4-1780-4FF6-BD18-167343C5AF16}
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_USERS\.DEFAULT\Control Panel\International\Geo
HKEY_USERS\.DEFAULT\Control Panel\International\Geo\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\LastECSETag
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\experiment_labels
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\PersistedPings\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\PersistedPingString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\PersistedPingTime
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\PersistedPings
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ExternalAppPingSent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ExternalAppHint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ExternalAppInstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ExternalAppCohort
HKEY_LOCAL_MACHINE\SYSTEM\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupSupported
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WinInit
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WinInit\Headless
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\OOBEDiagnosticsSent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\experiment_control_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\optedintoinsider
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\updatefreqhourshint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\rollbackrequested
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\optedintoinsider
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\experiment_control_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\updatefreqhourshint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\rollbackrequested
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\optedintoinsider
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\updatefreqhourshint
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdateDev\CdpNames\
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Clients\StartMenuInternet
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\EdgeUpdate\proxy
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\proxy\source
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\WinSock2\Parameters
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DnsClient
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\DNS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\QueryAdapterName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableAdapterDomainName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseDomainNameDevolution
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\UseDomainNameDevolution
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DomainNameDevolutionLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\PrioritizeRecordData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\PrioritizeRecordData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AllowUnqualifiedQuery
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\AllowUnqualifiedQuery
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AppendToMultiLabelName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ScreenBadTlds
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ScreenUnreachableServers
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ScreenDefaultServers
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DynamicServerQueryOrder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\FilterClusterIp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\WaitForNameErrorOnAll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseEdns
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsSecureNameQueryFallback
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableDAForAllNetworks
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DirectAccessQueryOrder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\QueryIpMatching
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseHostsFile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AddrConfigControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableSmartNameResolution
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\PreferLocalOverLowerBindingDNS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\QueryNetBTFQDN
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableSmartProtocolReordering
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UdpRecvBufferSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableParallelAandAAAA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableCoalescing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\FilterVPNTrigger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableMultiHomedRouteConflicts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ForceQueriesOverTcp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ShareTcpConnections
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationEnabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableDynamicUpdate
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterPrimaryName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterAdapterName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\EnableAdapterDomainNameRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterReverseLookup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableReverseAddressRegistrations
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterWanAdapters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableWanDynamicUpdate
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationTtl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DefaultRegistrationTTL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationRefreshInterval
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DefaultRegistrationRefreshInterval
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationMaxAddressCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\MaxNumberOfAddressesToRegister
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UpdateSecurityLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\UpdateSecurityLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UpdateTopLevelDomainZones
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DowncaseSpnCauseApiOwnerIsTooLazy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationOverwrite
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCacheSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCacheTtl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxNegativeCacheTtl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AdapterTimeoutLimit
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ServerPriorityTimeLimit
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCachedSockets
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableServerUnreachability
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableMulticast
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MulticastResponderFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MulticastSenderFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MulticastSenderMaxTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableMDNS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsTest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseCompartments
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\CacheAllCompartments
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseNewRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ResolverRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ResolverRegistrationOnly
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\NewDhcpSrvRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DirectAccessPreferLocal
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableIdnEncoding
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableIdnMapping
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ShortnameProxyDefault
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableNRPTForAdapterRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\TestMode_AdaptiveTimeoutHistoryLength
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\TestMode_AdaptiveTimeoutRecalculationInterval
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsQueryTimeouts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DnsQueryTimeouts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsQuickQueryTimeouts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DnsQuickQueryTimeouts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSClient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Classes\Local Settings\MuiCache\3\52C64B7E
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Local Settings\MuiCache\3\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7\Name
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Local Settings\MuiCache\3\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Cryptography\ECCParameters
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableSerialChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertSyncDeltaTime
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\SmartCardRoot
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\AutoFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableAutoFlushProcessNameList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\AutoFlushFirstDeltaSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\AutoFlushNextDeltaSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyCertificateChainPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCertificateChainPolicy
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\PinRulesLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\PinRules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\PinRulesLastSyncTime
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\PinRulesEncodedCtl
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ConsecutiveCheckFailures
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LatestRecommendedVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastCheckSuccess
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\LatestRecommendedVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\LastCheckSuccess
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\LatestRecommendedVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\LastCheckSuccess
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\LastChecked
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\State
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State\ImageState
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\PersistedPings\{753D568D-CA29-4956-AA4C-D2F6B81FE1F8}
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\SecurityService
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\UsageStats\Daily
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Timings
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Timings\updatecheck_succeeded_ms
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\worker_update_check_succeeded
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\worker_update_check_total
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans\worker_is_uac_disabled
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans\worker_is_windows_installing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers\worker_shell_version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers\omaha_version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans\is_system_install
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\goopdate_main
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\goopdate_constructor
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers\windows_major_version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\opt_in_uid_generated
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers\last_checked
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sList
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sDecimal
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sThousand
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sGrouping
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sNativeDigits
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sMonDecimalSep
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sMonThousandSep
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sMonGrouping
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sPositiveSign
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sNegativeSign
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sTimeFormat
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sShortTime
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\s1159
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\s2359
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sShortDate
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sYearMonth
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sLongDate
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iCountry
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iMeasure
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iPaperSize
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iDigits
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iLZero
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iNegNumber
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\NumShape
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iCurrDigits
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iCurrency
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iNegCurr
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iFirstWeekOfYear
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sCurrency
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iCalendarType
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Currencies
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Calendar
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Gregorian
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuildLabEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\CommercialId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\MachineId
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\DeviceAccess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\ActivePolicyCode
HKEY_LOCAL_MACHINE\System\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\consentcommunicated
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\urlstats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\previousedgepreviewvalue
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\edgepreviewdisenrollreason
HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsUpdate\UX\Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings\AllowAutoWindowsUpdateDownloadOverMeteredNetwork
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\consentcommunicated
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\urlstats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\previousedgepreviewvalue
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\edgepreviewdisenrollreason
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\allowautoupdatesmetered
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\consentcommunicated
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\urlstats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\previousedgepreviewvalue
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\edgepreviewdisenrollreason
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\allowautoupdatesmetered
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ECSExpiryConfig
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\WinSock_Registry_Version
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\3\52C64B7E
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob
HKEY_USERS\.DEFAULT\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\opv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\opv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\opv
HKEY_CLASSES_ROOT\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\AppID
HKEY_CURRENT_USER\Software\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\AccessPermission
HKEY_CURRENT_USER\Software\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}
HKEY_CURRENT_USER\Software\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\ThreadingModel
HKEY_CURRENT_USER\Software\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Classes\Unmarshalers\System\{00000338-0000-0000-C000-000000000046}
HKEY_CURRENT_USER\Software\Classes\Interface\{91D01F44-11D0-4F2B-B516-757A456F47B1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91D01F44-11D0-4F2B-B516-757A456F47B1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91D01F44-11D0-4F2B-B516-757A456F47B1}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}
HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\ThreadingModel
HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\AppID
HKEY_CURRENT_USER\Software\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\CustomAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateOnHostFlags
HKEY_CURRENT_USER\Software\Classes\CLSID\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}
HKEY_CURRENT_USER\Software\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF8E9480-CA73-448E-B8F0-DA000F581428}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\ThreadingModel
HKEY_CURRENT_USER\Software\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAEE35A-508D-4419-9E56-50D658C2C812}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}
HKEY_CURRENT_USER\Software\Classes\Interface\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{FA79A0EC-8AC2-40DB-A299-E5772593C226}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{0000000C-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\WerSvcGroup
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SCMConfig
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SCMConfig\EnableSvchostMitigationPolicy
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Diagnostics\PerfTrack\TraceProfile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SCMConfig\SvchostHeapReportingThresholdInKB
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wersvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Alias
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\ServiceDll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\ServiceManifest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\ServiceMain
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\LegacyCOMBehavior
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ServiceTimeout
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Consent
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Consent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\NewUserDefaultConsent
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Error Reporting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontSendAdditionalData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\DefaultConsent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\DefaultOverrideBehavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LoggingDisabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontShowUI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueuePesterInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DebugApplications
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\BypassDataThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceUserModeCabCollection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\BypassPowerThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\BypassNetworkCostThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueueNoPesterInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\AutoApproveOSDumps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LiveReportFlushInterval
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Windows Error Reporting
HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxQueueCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxArchiveCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ConfigureArchive
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableArchive
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUseSSL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerPortNumber
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUseAuthentication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MinFreeDiskSpace
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CabArchiveFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceHeapDump
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceMetadata
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Source
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\StorePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceEtw
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUploadOnFreeNetworksOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\UploadOnFreeNetworksOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CabArchiveSeparate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CabArchiveCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalCompression
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableWerUpload
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableEnterpriseAuthProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ArchiveFolderCountLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueueSizeMaxPercentFreeDisk
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MinQueueSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxRetriesForSasRenewal
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\NoHeapDumpOnQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DeferCabUpload
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DataCollection
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users
HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\System\AllowTelemetry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\PolicyType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\MergeAlgorithm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\RegKeyPathRedirectMapped
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\RegValueNameRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\Value
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry_PolicyManager
HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\current\Device\System
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\MSFTInternal
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\IsTest
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Debug
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\NoReflection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\DefaultUserEnviroment
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\TermReason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\424
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\424\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\424\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5116
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5116\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5116\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5116\Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5116\Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7928
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7928\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7928\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7928\Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7928\Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8288
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8288\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8288\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9116
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9116\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9116\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9148
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9148\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9148\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9148\Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9148\Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9184\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9184\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9184\Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9184\Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9204
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9204\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9204\CreationTime
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\ServiceDllUnloadOnStop
HKEY_CURRENT_USER\Software\Classes\AppID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\DllSurrogate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\MGOTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ProcessMitigationPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ProtectionLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ThreadingModel
HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AppID
HKEY_CURRENT_USER\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\Elevation
HKEY_CURRENT_USER\Software\Classes\Interface\{75121952-E0D0-43E5-9380-1D80483ACF72}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75121952-e0d0-43e5-9380-1d80483acf72}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75121952-e0d0-43e5-9380-1d80483acf72}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}
HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\ThreadingModel
HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocHandler32
HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\AppID
HKEY_CURRENT_USER\Software\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\Elevation

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\channel
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-AU
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-AU
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\000603xx
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-AU
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\OEM\DeviceForm
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\UBR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DisplayVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\Com+Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundExecutionManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Diagnostics.AsyncCausalityTracer\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotificationManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000035-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b03c2205-f02e-4d77-80df-e1747afdd39c}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7ab93c52-0e48-4750-ba9d-1a4113981847}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3bc3d253-2f31-4092-9129-8ad5abf067da}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\PolicyType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\MergeAlgorithm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\RegKeyPathRedirectMapped
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\grouppolicypath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\grouppolicyismultisz
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\grouppolicymultiszSeparatorChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\Value
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0c9281f9-6da1-4006-8729-de6e6b61581c}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\PolicyType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\grouppolicypath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Containers\WaitForRestore
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\PolicyType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\MergeAlgorithm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\RegKeyPathRedirectMapped
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\grouppolicypath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\grouppolicyismultisz
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\Value
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\MergeAlgorithm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\RegKeyPathRedirectMapped
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\grouppolicypath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\Value
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.User\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ExePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\IdentityType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ServerType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\Identity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ServiceName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ExplicitPsmActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5232f8ea-49c7-4840-bfbb-66e785689e88}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Package\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{679C64B7-81AB-42C2-8819-C958767753F4}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{195f5943-0c04-4eab-b907-735817fdac77}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F655B052-348B-4AB0-947B-A7DAFA44D404}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{58058629-16A1-438A-90C8-7E954B3734B1}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\AppPackageType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\PackageSid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\ApplicationFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_UserInControlOfTheseApps\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.LimitedAccessFeatures\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceAllowTheseApps\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\grouppolicymultiszSeparatorChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground_ForceDenyTheseApps\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\grouppolicyismultisz
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\grouppolicymultiszSeparatorChar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\Privacy\LetAppsRunInBackground\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\CapAuthz\ApplicationsEx\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\CapSids
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\PackageRepositoryRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\LimitedAccessFeatures\com.microsoft.windows.taskbar.requestPinSecondaryTile\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.CryptographicBuffer\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmNames\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Security.Cryptography.Core.HashAlgorithmProvider\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\LimitedAccessFeatures\com.microsoft.windows.taskbar.requestPinSecondaryTile\Expiration
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Core.CoreApplication\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.PropertySet\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\XAML\OneCoreTransformsEnabledByDefault
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.PropertyValue\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.SecondaryTile\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.SecondaryTileStore\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundTaskRegistration\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.Internal.UserManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ExePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\CommandLine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ServiceName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ExplicitPsmActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ActivatableClasses
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\ServerType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\UserManager\Identity
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.ApplicationModel.Background.BackgroundWorkManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Foundation.Collections.ValueSet\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataWriter\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.Streams.DataReader\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.SecondaryTileView\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.Application\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{d81e96f1-a89c-417e-9335-59531026309d}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{9ed07b24-36fd-543b-948e-b01fe5814b49}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{efe869fc-5841-55f1-aa56-82c7219aaa09}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Shell.TaskbarManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.StartScreen.StartScreenManager\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.System.User\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.Tiles.TileStore\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.TileView\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\PinnableSurfaces\DefaultStart
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.ApplicationModel.StartPinnableSurface\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\AdminCapabilities\shellExperience
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.ApplicationData\ActivateOnHostFlags
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\PSR\WnfStateName
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3968686040-3210279463-847977608-1001\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-300300000000}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Data
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-100000000000}\Generation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Data
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{528c102f-0000-0000-0000-c0dd0e000000}\Generation
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowStatusBar
HKEY_CURRENT_USER\Software\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_CURRENT_USER\Software\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_CURRENT_USER\Software\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_CURRENT_USER\Software\Classes\Directory\AlwaysShowExt
HKEY_CURRENT_USER\Software\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InitFolderHandler
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Personal
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\pv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\edgeupdate_service_name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\edgeupdate\Alias
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\STE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\MDMEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Appx\AllowDevelopmentWithoutDevLicense
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock\AllowDevelopmentWithoutDevLicense
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseActivationAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\MicrosoftEdgeUpdate.exe\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34EAF827-6C36-4CEF-8A9C-7C9842355641}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020420-0000-0000-C000-000000000046}\AppID
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.System.Profile.RegionPolicyEvaluator\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFile\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SecurityManager\AdminCapabilities\packageContents
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\InitFolderHandler
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{A520A1A4-1780-4FF6-BD18-167343C5AF16}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Storage.StorageFileStaticsBrokered\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00000035-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\GipActivityBypass
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5984C710-DAF2-43C8-8BB4-A4D3EACFD03F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5E52F8CE-ACED-5A42-95B4-F674DD84885E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\MonitorRegistry
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\FolderValueFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\ValidateRegItems
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\MonitorRegistry
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Common Start Menu
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Recent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\DefinitionFlags
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Internal.StateRepository.FileTypeAssociation\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\CommandLine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\Server\StateRepository\ActivatableClasses
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8645456f-d9a2-4b82-afec-58f0e8df0acf}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{89bc3f49-f8d9-5103-ba13-de497e609167}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\PropertySystem\SystemPropertyHandlers\.json
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\PerceivedType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\SystemIndexNormalization
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.json
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.json\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Unknown\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\name
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\client
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\oobeinstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\updatecount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NormalizeLinkNetPidls
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation\UseLocalMachineSoftwareClassesWhenImpersonating
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.exe\NeverShowExt
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\lastrun
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\InactivityBadgeApplied
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\freseen
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\freseenversion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\client
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\oobeinstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\updatecount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\client
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\oobeinstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\updatecount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\OemInstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\2\ServiceName
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid\ABshOnzU
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid-num-rotations
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\UBR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsSelfHost\Applicability\EnablePreviewBuilds
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{A520A1A4-1780-4FF6-BD18-167343C5AF16}
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Control Panel\International\Geo\Name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\LastECSETag
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ExternalAppPingSent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ExternalAppHint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ExternalAppInstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ExternalAppCohort
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupSupported
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WinInit\Headless
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\OOBEDiagnosticsSent
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\experiment_control_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\optedintoinsider
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\updatefreqhourshint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\rollbackrequested
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\optedintoinsider
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\experiment_control_labels
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\updatefreqhourshint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\rollbackrequested
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\optedintoinsider
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\updatefreqhourshint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid-create-time
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\proxy\source
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\QueryAdapterName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableAdapterDomainName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseDomainNameDevolution
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\UseDomainNameDevolution
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DomainNameDevolutionLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\PrioritizeRecordData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\PrioritizeRecordData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AllowUnqualifiedQuery
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\AllowUnqualifiedQuery
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AppendToMultiLabelName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ScreenBadTlds
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ScreenUnreachableServers
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ScreenDefaultServers
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DynamicServerQueryOrder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\FilterClusterIp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\WaitForNameErrorOnAll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseEdns
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsSecureNameQueryFallback
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableDAForAllNetworks
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DirectAccessQueryOrder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\QueryIpMatching
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseHostsFile
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AddrConfigControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableSmartNameResolution
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\PreferLocalOverLowerBindingDNS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\QueryNetBTFQDN
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableSmartProtocolReordering
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UdpRecvBufferSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableParallelAandAAAA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableCoalescing
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\FilterVPNTrigger
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableMultiHomedRouteConflicts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ForceQueriesOverTcp
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ShareTcpConnections
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationEnabled
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableDynamicUpdate
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterPrimaryName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterAdapterName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\EnableAdapterDomainNameRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterReverseLookup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableReverseAddressRegistrations
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegisterWanAdapters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DisableWanDynamicUpdate
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationTtl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DefaultRegistrationTTL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationRefreshInterval
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DefaultRegistrationRefreshInterval
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationMaxAddressCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\MaxNumberOfAddressesToRegister
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UpdateSecurityLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\UpdateSecurityLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UpdateTopLevelDomainZones
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DowncaseSpnCauseApiOwnerIsTooLazy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\RegistrationOverwrite
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCacheSize
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCacheTtl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxNegativeCacheTtl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\AdapterTimeoutLimit
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ServerPriorityTimeLimit
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MaxCachedSockets
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableServerUnreachability
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableMulticast
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MulticastResponderFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MulticastSenderFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\MulticastSenderMaxTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableMDNS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsTest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseCompartments
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\CacheAllCompartments
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\UseNewRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ResolverRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ResolverRegistrationOnly
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\NewDhcpSrvRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DirectAccessPreferLocal
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableIdnEncoding
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\EnableIdnMapping
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\ShortnameProxyDefault
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DisableNRPTForAdapterRegistration
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\TestMode_AdaptiveTimeoutHistoryLength
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\TestMode_AdaptiveTimeoutRecalculationInterval
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsQueryTimeouts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DnsQueryTimeouts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters\DnsQuickQueryTimeouts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\DnsQuickQueryTimeouts
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Local Settings\MuiCache\3\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7\Name
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\Local Settings\MuiCache\3\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableSerialChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertSyncDeltaTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\AutoFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableAutoFlushProcessNameList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\AutoFlushFirstDeltaSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\AutoFlushNextDeltaSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\7EED6032C9F56387EC734CBBF32BFC14DB6DE0A2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\PinRulesLogDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\PinRules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\PinRulesLastSyncTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\PinRulesEncodedCtl
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State\ImageState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService\DefaultAuthLevel
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Timings\updatecheck_succeeded_ms
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\worker_update_check_succeeded
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\worker_update_check_total
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\goopdate_main
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\goopdate_constructor
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\opt_in_uid_generated
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableUmpdBufferSizeCheck
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sList
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sDecimal
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sThousand
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sGrouping
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sNativeDigits
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sMonDecimalSep
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sMonThousandSep
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sMonGrouping
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sPositiveSign
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sNegativeSign
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sTimeFormat
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sShortTime
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\s1159
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\s2359
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sShortDate
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sYearMonth
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sLongDate
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iCountry
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iMeasure
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iPaperSize
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iDigits
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iLZero
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iNegNumber
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\NumShape
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iCurrDigits
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iCurrency
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iNegCurr
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iFirstWeekOfYear
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\sCurrency
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\iCalendarType
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Currencies
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\Control Panel\International\\xed\xa0\xbc\xed\xbc\x8e\xed\xa0\xbc\xed\xbc\x8f\xed\xa0\xbc\xed\xbc\x8d\Calendar
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuildLabEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\CommercialId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\MachineId
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DeviceAccess\ActivePolicyCode
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\consentcommunicated
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\urlstats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\previousedgepreviewvalue
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\edgepreviewdisenrollreason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings\AllowAutoWindowsUpdateDownloadOverMeteredNetwork
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\consentcommunicated
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\urlstats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\previousedgepreviewvalue
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\edgepreviewdisenrollreason
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\allowautoupdatesmetered
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\consentcommunicated
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\urlstats
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\previousedgepreviewvalue
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\edgepreviewdisenrollreason
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\allowautoupdatesmetered
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ECSExpiryConfig
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\WinSock_Registry_Version
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\3\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\F8A408B8FBEEA077B75738658641BE77154720EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\B5EE89E77326AB2BF1775BD99C19A28947FF8184
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\opv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\opv
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\opv
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{7E55A26D-EF95-4A45-9F55-21E52ADF9887}\AccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08728914-3F57-4D52-9E31-49DAECA5A80A}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{91D01F44-11D0-4F2B-B516-757A456F47B1}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{82345212-6ACA-4B38-8CD7-BF9DE8ED07BD}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.Data.Xml.Dom.XmlDocument\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\ResourcePolicies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivationType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Server
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\DllPath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Threading
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\TrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\RemoteServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateAsUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateInSharedBroker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateInBrokerForMediumILContainer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\Permissions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId\Windows.UI.Notifications.ToastNotification\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DF8E9480-CA73-448E-B8F0-DA000F581428}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAEE35A-508D-4419-9E56-50D658C2C812}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{7C2F0BD8-EC37-4A41-81AA-D33343E5C4D1}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FA79A0EC-8AC2-40DB-A299-E5772593C226}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4F38FD3E-2C10-4C00-9EC1-62BD536A1FEB}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0000000c-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B7C65660-A5AF-43E7-8DF2-EA586087C05A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{473A27A0-21CA-4A7D-8BF3-569DE32B240C}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\WerSvcGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SCMConfig\EnableSvchostMitigationPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SCMConfig\SvchostHeapReportingThresholdInKB
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Alias
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\ServiceDll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\ServiceManifest
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\ServiceMain
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\LegacyCOMBehavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ServiceTimeout
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\NewUserDefaultConsent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontSendAdditionalData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Disabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\DefaultConsent
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\DefaultOverrideBehavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LoggingDisabled
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontShowUI
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueuePesterInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\BypassDataThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceUserModeCabCollection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\BypassPowerThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\BypassNetworkCostThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueueNoPesterInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\AutoApproveOSDumps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LiveReportFlushInterval
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxQueueCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxArchiveCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ConfigureArchive
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableArchive
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerServer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUseSSL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerPortNumber
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUseAuthentication
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MinFreeDiskSpace
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CabArchiveFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceHeapDump
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceMetadata
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Source
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\User
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\StorePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ForceEtw
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CorporateWerUploadOnFreeNetworksOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\UploadOnFreeNetworksOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CabArchiveSeparate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\CabArchiveCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalCompression
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableWerUpload
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DisableEnterpriseAuthProxy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\ArchiveFolderCountLimit
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\QueueSizeMaxPercentFreeDisk
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MinQueueSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\MaxRetriesForSasRenewal
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\NoHeapDumpOnQueue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DeferCabUpload
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\PolicyType
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\Behavior
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\MergeAlgorithm
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\RegKeyPathRedirectMapped
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\RegKeyPathRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\RegValueNameRedirect
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\grouppolicyname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\ADMXMetadataUser
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\ADMXMetadataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\ADMXMetadataBoth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\30Value
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\default\System\AllowTelemetry\Value
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry_PolicyManager
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\MSFTInternal
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\IsTest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\NoReflection
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\424\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5116\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5116\Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\5116\Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7928\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7928\Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7928\Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\8288\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9116\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9148\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9148\Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9148\Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9184\CreationTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9184\Reason
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9184\Terminator
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\9204\CreationTime
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WerSvc\Parameters\ServiceDllUnloadOnStop
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\DllSurrogate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\MGOTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ProcessMitigationPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ProtectionLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\DefaultAccessPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{75121952-e0d0-43e5-9380-1d80483acf72}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\ActivateOnHostFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F562A2C8-E850-4F05-8E7A-E7192E4E6C23}\AppID

HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid-create-time
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid-num-rotations
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\uid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid\ABshOnzU
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\PersistedPings\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\PersistedPingString
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\PersistedPings\{3FCB36C4-1BC7-4FF6-960A-C472F90B0569}\PersistedPingTime
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\proxy\source
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ConsecutiveCheckFailures
HKEY_USERS\S-1-5-21-3968686040-3210279463-847977608-1001\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LatestRecommendedVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastCheckSuccess
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\LatestRecommendedVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\LastCheckSuccess
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\LatestRecommendedVersion
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\LastCheckSuccess
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\LastChecked
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\Software\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Timings\updatecheck_succeeded_ms
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\worker_update_check_succeeded
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\worker_update_check_total
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans\worker_is_uac_disabled
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans\worker_is_windows_installing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers\worker_shell_version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers\omaha_version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Booleans\is_system_install
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\goopdate_main
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\goopdate_constructor
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers\windows_major_version
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Counts\opt_in_uid_generated
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\UsageStats\Daily\Integers\last_checked

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\uid
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientState\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\UpdateAvailableSince

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x344,0x35c,0x7fff16f35d58,0x7fff16f35d64,0x7fff16f35d70
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2388,i,8823613399287029355,12022979517610140969,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2580 /prefetch:3
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2180,i,16090793344968355769,14585619003076371751,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2440 /prefetch:2
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2724,i,17890292518401804609,7034942189224193145,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2764 /prefetch:8
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186407985 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3560,i,11676548911406118748,16820735849445238907,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3556 /prefetch:1
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=186410130 --skip-read-main-dll --metrics-shmem-handle=3668,i,2396491602889113873,12485579353753644802,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3748 /prefetch:1
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5328,i,12626311780650901669,14176311243473770968,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5368 /prefetch:8
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5340,i,17745413209609224926,8469148961402733420,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5428 /prefetch:8
"C:\Program Files (x86)\Microsoft\Edge\Application\148.0.3967.83\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=6048,i,2971723425194365174,16206758529383860314,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5236 /prefetch:8
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,13601508909079690424,398805377896742876,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3676 /prefetch:8
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1780051276110588 --launch-time-ticks=219783184 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6168,i,11591325124669200099,14631802058767790145,2097152 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=1624 /prefetch:1
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5412,i,5337591086858526967,16474943761420232357,524288 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=6432 /prefetch:8
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.3636 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4004,i,7092498328383177707,8111344416296456205,262144 --field-trial-handle=2456,i,5241159451444011597,10090642637214373156,262144 --variations-seed-version --pseudonymization-salt-handle=2460,i,13440712079067794296,11993316022864094159,4 --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=3448 /prefetch:8
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\svchost.exe -k netsvcs -p
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4yMzMuMyIgc2hlbGxfdmVyc2lvbj0iMS4zLjIzMy4zIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0iezkxRDY1M0YwLTc4OEItNDM2OS04M0ExLTRCMkJEM0U2OTdDOX0iIHVzZXJpZD0ie0JFRkJDQjc3LTYzRjgtNDI5RS04ODYzLUYwREM4MjE0REVFNn0iIGluc3RhbGxzb3VyY2U9InNjaGVkdWxlciIgcmVxdWVzdGlkPSJ7NzUzRDU2OEQtQ0EyOS00OTU2LUFBNEMtRDJGNkI4MUZFMUY4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjYiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS4zODAzIiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkFTVVMiIHByb2R1Y3RfbmFtZT0iUFJJTUUgQjQ1ME0tQSBJSSIvPjxleHAgZXRhZz0iJnF1b3Q7WjRZTkFXUE1PbEhKYnZnWDNlYjZzZ3h4dkJBalRmWkxiUnBOZ2RkdUwrbz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjIzMy4zIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC40NSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIxIiByZD0iNzA4NyIgcGluZ19mcmVzaG5lc3M9IntCODcwRTY5Ni04NUExLTQ3OEItQUM4Mi1BMDc5RDkzMEM3N0N9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjE0OC4wLjM5NjcuODMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMCIgY29ob3J0PSJycmZAMC45OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzNDI0NDU1NTc3ODQ3OTI1MCIgdXBkYXRlX2NvdW50PSIxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTM0MjQ1MjUwNjI1NjU4NjEwIiBmaXJzdF9mcmVfc2Vlbl90aW1lPSIxMzQyNDQ1NjAwNzMxMTY0MjAiIGZpcnN0X2ZyZV9zZWVuX3ZlcnNpb249IjE0OC4wLjM5NjcuODMiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIxIiByPSIxIiBhZD0iNzA4NyIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MjNDNzlBODMtMjBBOS00RkIwLTgzRkQtMjJBQTNGQUUwQTcxfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxNDguMC4zOTY3LjgzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJFVVdWIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjcwODQiIGNvaG9ydD0icnJmQDAuNTMiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMSIgcmQ9IjcwODciIHBpbmdfZnJlc2huZXNzPSJ7MTM1NTFDMEMtNUIyMS00RkU3LTg2OUYtM0EwOTczRTdEQUY1fSIvPjwvYXBwPjwvcmVxdWVzdD4
C:\Windows\system32\WerFault.exe -pss -s 688 -p 8756 -ip 8756
C:\Windows\system32\WerFault.exe -u -p 8756 -s 284

Local\SM0:9656:304:WilStaging_02
Local\SM0:9656:120:WilError_03
__OMADM_NAMED_MUTEX__
_Microsoft_EdgeUpdate_logging_mutex_C:ProgramDataMicrosoftEdgeUpdateLogMicrosoftEdgeUpdate.log
Global\EdgeUpdate{76524F9B-42D7-48C8-B7DF-FAB9E93834BF}
Global\EdgeUpdate{9FE41F29-8211-488D-B96A-81FCD0A8ACE3}
Global\EdgeUpdate{8A5FF6DC-FF03-4CB3-8834-D3AD1DE301DF}
Local\SM0:5932:168:WilStaging_02
Local\SM0:5932:64:WilError_03
Global\EdgeUpdate{DDDDEAEB-04CC-4BAA-9C63-CCA5FE38F688}
Global\EdgeUpdate{921D73A1-67B6-4E73-81EA-8A162D92D990}
Local\SM0:11836:120:WilError_03
Local\SM0:11836:304:WilStaging_02
Local\SM0:13492:304:WilStaging_02

edgeupdate
wisvc

No results found.

No behavioral analysis data available.

Sorry! No strace.

Sorry! No tracee.

Hosts (0)
DNS (0)

Hosts

No hosts contacted.

TCP Connections

No TCP connections recorded.

UDP Connections

No UDP connections recorded.

DNS Requests

No domains contacted.

HTTP Requests

No HTTP(s) requests performed.

SMTP Traffic

No SMTP traffic performed.

IRC Traffic

No IRC requests performed.

ICMP Traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No Suricata Extracted files.

No dropped files found.

No CAPE payloads found.

Sorry! No process dumps.

Analysis Details

Options

Analysis Log

Process Log

Pre-Script Log

During-Script Log

Machine Information

URL Details

Statistics 6.03s

Signatures

Session Playback

Hosts

DNS

Summary

Hosts

TCP Connections

UDP Connections

DNS Requests

HTTP Requests

SMTP Traffic

IRC Traffic

ICMP Traffic

CIF Results

Suricata Alerts

Suricata TLS

Suricata HTTP