Detections

Yara:

Loki

Analysis

Category Package Started Completed Duration Options Log
FILE exe 2020-06-23 05:59:27 2020-06-23 06:05:17 350 seconds Show Options Show Log
route = tor
2020-05-13 09:27:43,005 [root] INFO: Date set to: 20200623T05:58:24, timeout set to: 200
2020-06-23 05:58:24,078 [root] DEBUG: Starting analyzer from: C:\tmpt2nfl3rg
2020-06-23 05:58:24,078 [root] DEBUG: Storing results at: C:\JAAycO
2020-06-23 05:58:24,078 [root] DEBUG: Pipe server name: \\.\PIPE\etdyAjbpsf
2020-06-23 05:58:24,078 [root] DEBUG: Python path: C:\Users\Louise\AppData\Local\Programs\Python\Python38-32
2020-06-23 05:58:24,078 [root] DEBUG: No analysis package specified, trying to detect it automagically.
2020-06-23 05:58:24,078 [root] INFO: Automatically selected analysis package "exe"
2020-06-23 05:58:24,078 [root] DEBUG: Trying to import analysis package "exe"...
2020-06-23 05:58:24,140 [root] DEBUG: Imported analysis package "exe".
2020-06-23 05:58:24,140 [root] DEBUG: Trying to initialize analysis package "exe"...
2020-06-23 05:58:24,140 [root] DEBUG: Initialized analysis package "exe".
2020-06-23 05:58:24,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.browser"...
2020-06-23 05:58:24,187 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser".
2020-06-23 05:58:24,187 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.curtain"...
2020-06-23 05:58:24,203 [root] DEBUG: Imported auxiliary module "modules.auxiliary.curtain".
2020-06-23 05:58:24,203 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.digisig"...
2020-06-23 05:58:24,218 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig".
2020-06-23 05:58:24,218 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.disguise"...
2020-06-23 05:58:24,249 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise".
2020-06-23 05:58:24,249 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.human"...
2020-06-23 05:58:24,265 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human".
2020-06-23 05:58:24,265 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.procmon"...
2020-06-23 05:58:24,281 [root] DEBUG: Imported auxiliary module "modules.auxiliary.procmon".
2020-06-23 05:58:24,281 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.screenshots"...
2020-06-23 05:58:24,281 [modules.auxiliary.screenshots] DEBUG: Importing 'time'
2020-06-23 05:58:24,281 [modules.auxiliary.screenshots] DEBUG: Importing 'StringIO'
2020-06-23 05:58:24,281 [modules.auxiliary.screenshots] DEBUG: Importing 'Thread'
2020-06-23 05:58:24,281 [modules.auxiliary.screenshots] DEBUG: Importing 'Auxiliary'
2020-06-23 05:58:24,281 [modules.auxiliary.screenshots] DEBUG: Importing 'NetlogFile'
2020-06-23 05:58:24,281 [modules.auxiliary.screenshots] DEBUG: Importing 'Screenshot'
2020-06-23 05:58:24,281 [lib.api.screenshot] DEBUG: Importing 'math'
2020-06-23 05:58:24,281 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2020-06-23 05:58:25,156 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageGrab'
2020-06-23 05:58:25,421 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageDraw'
2020-06-23 05:58:25,562 [modules.auxiliary.screenshots] DEBUG: Imports OK
2020-06-23 05:58:25,562 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots".
2020-06-23 05:58:25,562 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.sysmon"...
2020-06-23 05:58:25,671 [root] DEBUG: Imported auxiliary module "modules.auxiliary.sysmon".
2020-06-23 05:58:25,671 [root] DEBUG: Trying to import auxiliary module "modules.auxiliary.usage"...
2020-06-23 05:58:25,718 [root] DEBUG: Imported auxiliary module "modules.auxiliary.usage".
2020-06-23 05:58:25,718 [root] DEBUG: Trying to initialize auxiliary module "Browser"...
2020-06-23 05:58:25,718 [root] DEBUG: Initialized auxiliary module "Browser".
2020-06-23 05:58:25,718 [root] DEBUG: Trying to start auxiliary module "Browser"...
2020-06-23 05:58:25,812 [root] DEBUG: Started auxiliary module Browser
2020-06-23 05:58:25,812 [root] DEBUG: Trying to initialize auxiliary module "Curtain"...
2020-06-23 05:58:25,812 [root] DEBUG: Initialized auxiliary module "Curtain".
2020-06-23 05:58:25,812 [root] DEBUG: Trying to start auxiliary module "Curtain"...
2020-06-23 05:58:25,859 [root] DEBUG: Started auxiliary module Curtain
2020-06-23 05:58:25,859 [root] DEBUG: Trying to initialize auxiliary module "DigiSig"...
2020-06-23 05:58:25,859 [root] DEBUG: Initialized auxiliary module "DigiSig".
2020-06-23 05:58:25,859 [root] DEBUG: Trying to start auxiliary module "DigiSig"...
2020-06-23 05:58:25,859 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature.
2020-06-23 05:58:26,390 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-06-23 05:58:26,390 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-06-23 05:58:26,406 [root] DEBUG: Started auxiliary module DigiSig
2020-06-23 05:58:26,406 [root] DEBUG: Trying to initialize auxiliary module "Disguise"...
2020-06-23 05:58:26,406 [root] DEBUG: Initialized auxiliary module "Disguise".
2020-06-23 05:58:26,406 [root] DEBUG: Trying to start auxiliary module "Disguise"...
2020-06-23 05:58:26,453 [root] DEBUG: Started auxiliary module Disguise
2020-06-23 05:58:26,453 [root] DEBUG: Trying to initialize auxiliary module "Human"...
2020-06-23 05:58:26,468 [root] DEBUG: Initialized auxiliary module "Human".
2020-06-23 05:58:26,468 [root] DEBUG: Trying to start auxiliary module "Human"...
2020-06-23 05:58:26,468 [root] DEBUG: Started auxiliary module Human
2020-06-23 05:58:26,468 [root] DEBUG: Trying to initialize auxiliary module "Procmon"...
2020-06-23 05:58:26,484 [root] DEBUG: Initialized auxiliary module "Procmon".
2020-06-23 05:58:26,484 [root] DEBUG: Trying to start auxiliary module "Procmon"...
2020-06-23 05:58:26,484 [root] DEBUG: Started auxiliary module Procmon
2020-06-23 05:58:26,484 [root] DEBUG: Trying to initialize auxiliary module "Screenshots"...
2020-06-23 05:58:26,484 [root] DEBUG: Initialized auxiliary module "Screenshots".
2020-06-23 05:58:26,484 [root] DEBUG: Trying to start auxiliary module "Screenshots"...
2020-06-23 05:58:26,484 [root] DEBUG: Started auxiliary module Screenshots
2020-06-23 05:58:26,500 [root] DEBUG: Trying to initialize auxiliary module "Sysmon"...
2020-06-23 05:58:26,500 [root] DEBUG: Initialized auxiliary module "Sysmon".
2020-06-23 05:58:26,500 [root] DEBUG: Trying to start auxiliary module "Sysmon"...
2020-06-23 05:58:26,500 [root] DEBUG: Started auxiliary module Sysmon
2020-06-23 05:58:26,500 [root] DEBUG: Trying to initialize auxiliary module "Usage"...
2020-06-23 05:58:26,500 [root] DEBUG: Initialized auxiliary module "Usage".
2020-06-23 05:58:26,500 [root] DEBUG: Trying to start auxiliary module "Usage"...
2020-06-23 05:58:26,609 [root] DEBUG: Started auxiliary module Usage
2020-06-23 05:58:26,625 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL option
2020-06-23 05:58:26,625 [root] INFO: Analyzer: Package modules.packages.exe does not specify a DLL_64 option
2020-06-23 05:58:26,640 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2020-06-23 05:58:26,640 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2020-06-23 05:58:27,249 [lib.api.process] INFO: Successfully executed process from path "C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.exe" with arguments "" with pid 1156
2020-06-23 05:58:27,265 [lib.api.process] INFO: Monitor config for process 1156: C:\tmpt2nfl3rg\dll\1156.ini
2020-06-23 05:58:27,296 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:58:27,812 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:58:27,843 [root] DEBUG: Loader: Injecting process 1156 (thread 268) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:27,843 [root] DEBUG: Process image base: 0x00400000
2020-06-23 05:58:27,843 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:27,843 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 05:58:27,859 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:27,859 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1156
2020-06-23 05:58:29,859 [lib.api.process] INFO: Successfully resumed process with pid 1156
2020-06-23 05:58:30,468 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:58:30,484 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:58:30,562 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-23 05:58:30,578 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1156 at 0x701b0000, image base 0x400000, stack from 0x186000-0x190000
2020-06-23 05:58:30,625 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.exe".
2020-06-23 05:58:30,671 [root] INFO: Disabling sleep skipping.
2020-06-23 05:58:30,671 [root] INFO: Loaded monitor into process with pid 1156
2020-06-23 05:58:30,671 [root] INFO: Disabling sleep skipping.
2020-06-23 05:58:30,687 [root] INFO: Disabling sleep skipping.
2020-06-23 05:58:30,687 [root] INFO: Disabling sleep skipping.
2020-06-23 05:58:30,687 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1156, handle 0xd4.
2020-06-23 05:58:30,718 [root] DEBUG: set_caller_info: Adding region at 0x03620000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-06-23 05:58:30,734 [root] DEBUG: set_caller_info: Adding region at 0x01CB0000 to caller regions list (kernel32::GetSystemTime).
2020-06-23 05:58:30,734 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1cb0000
2020-06-23 05:58:30,750 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01CB0000 size 0x400000.
2020-06-23 05:58:30,750 [root] DEBUG: DumpPEsInRange: Scanning range 0x1cb0000 - 0x1cb1000.
2020-06-23 05:58:30,750 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1cb0000-0x1cb1000.
2020-06-23 05:58:31,921 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JAAycO\CAPE\1156_132902525230181223262020 (size 0xffe)
2020-06-23 05:58:31,921 [root] DEBUG: DumpRegion: Dumped stack region from 0x01CB0000, size 0x1000.
2020-06-23 05:58:32,140 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JAAycO\CAPE\1156_193682408531181223262020 (size 0x8020)
2020-06-23 05:58:32,156 [root] DEBUG: set_caller_info: Adding region at 0x03640000 to caller regions list (ntdll::memcpy).
2020-06-23 05:58:32,187 [root] DEBUG: DumpMemory: CAPE output file successfully created: C:\JAAycO\CAPE\1156_43547447232181223262020 (size 0x1a)
2020-06-23 05:58:32,187 [root] DEBUG: DumpRegion: Dumped stack region from 0x03640000, size 0x1000.
2020-06-23 05:58:32,249 [root] INFO: Announced 32-bit process name: q2w0yYbvMGBN.exe pid: 3360
2020-06-23 05:58:32,249 [lib.api.process] INFO: Monitor config for process 3360: C:\tmpt2nfl3rg\dll\3360.ini
2020-06-23 05:58:32,249 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:58:32,281 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:58:32,281 [root] DEBUG: Loader: Injecting process 3360 (thread 1408) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:32,296 [root] DEBUG: Process image base: 0x00400000
2020-06-23 05:58:32,296 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:32,296 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 05:58:32,296 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:32,296 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3360
2020-06-23 05:58:32,312 [root] DEBUG: DLL loaded at 0x75300000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-23 05:58:32,359 [root] DEBUG: DLL unloaded from 0x00400000.
2020-06-23 05:58:32,359 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.exe" .
2020-06-23 05:58:32,359 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3360, ImageBase: 0x00400000
2020-06-23 05:58:32,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x11c amd local view 0x03C70000 to global list.
2020-06-23 05:58:32,375 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x11c to target process 3360.
2020-06-23 05:58:32,375 [root] INFO: Announced 32-bit process name: q2w0yYbvMGBN.exe pid: 3360
2020-06-23 05:58:32,375 [lib.api.process] INFO: Monitor config for process 3360: C:\tmpt2nfl3rg\dll\3360.ini
2020-06-23 05:58:32,375 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:58:32,390 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:58:32,390 [root] DEBUG: Loader: Injecting process 3360 (thread 0) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:32,406 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x7EFDE000 Local PEB 0x7EFDD000 Local TEB 0x7EFDE000: The operation completed successfully.
2020-06-23 05:58:32,406 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 1408, handle 0xc4
2020-06-23 05:58:32,406 [root] DEBUG: Process image base: 0x00400000
2020-06-23 05:58:32,406 [root] DEBUG: InjectDllViaIAT: Executable DOS header zero.
2020-06-23 05:58:32,406 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:32,421 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3360
2020-06-23 05:58:32,421 [root] DEBUG: SetThreadContextHandler: Hollow process entry point reset via NtSetContextThread to 0x000139DE (process 3360).
2020-06-23 05:58:32,421 [root] INFO: Announced 32-bit process name: q2w0yYbvMGBN.exe pid: 3360
2020-06-23 05:58:32,421 [lib.api.process] INFO: Monitor config for process 3360: C:\tmpt2nfl3rg\dll\3360.ini
2020-06-23 05:58:32,421 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:58:32,468 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:58:32,468 [root] DEBUG: Loader: Injecting process 3360 (thread 1408) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:32,468 [root] DEBUG: Process image base: 0x00400000
2020-06-23 05:58:32,468 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:32,484 [root] DEBUG: InjectDllViaIAT: Memory region at 0x07000000 not empty.
2020-06-23 05:58:32,484 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 05:58:32,484 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:58:32,484 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3360
2020-06-23 05:58:32,484 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-23 05:58:32,500 [root] DEBUG: DumpProcess: Module entry point VA is 0x000139DE.
2020-06-23 05:58:32,562 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x18200.
2020-06-23 05:58:32,562 [root] DEBUG: ResumeThreadHandler: Dumped PE image from buffer.
2020-06-23 05:58:32,562 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3360.
2020-06-23 05:58:32,562 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x3c70000
2020-06-23 05:58:32,562 [root] DEBUG: DumpSectionViewsForPid: Dumping PE image from shared section view, local address 0x03C70000.
2020-06-23 05:58:32,578 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 05:58:32,578 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x03C70000.
2020-06-23 05:58:32,578 [root] DEBUG: DumpProcess: Module entry point VA is 0x000139DE.
2020-06-23 05:58:32,578 [root] DEBUG: readPeSectionsFromProcess: Failed to relocate image back to header image base 0x00400000.
2020-06-23 05:58:32,593 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x18200.
2020-06-23 05:58:32,593 [root] DEBUG: DumpSectionViewsForPid: Dumped PE image from shared section view.
2020-06-23 05:58:32,609 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3c70001-0x3d12000.
2020-06-23 05:58:32,609 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1156
2020-06-23 05:58:32,609 [root] DEBUG: GetHookCallerBase: thread 2372 (handle 0x0), return address 0x036236E2, allocation base 0x03620000.
2020-06-23 05:58:32,609 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00400000.
2020-06-23 05:58:32,609 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 05:58:32,609 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-06-23 05:58:32,609 [root] DEBUG: DumpProcess: Module entry point VA is 0x0006282C.
2020-06-23 05:58:32,671 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:58:32,687 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:58:32,687 [root] INFO: Disabling sleep skipping.
2020-06-23 05:58:32,687 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-23 05:58:32,687 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3360 at 0x701b0000, image base 0x400000, stack from 0x186000-0x190000
2020-06-23 05:58:32,703 [root] DEBUG: Commandline: C:\Users\Louise\AppData\Local\Temp\"C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.exe".
2020-06-23 05:58:32,781 [root] INFO: Loaded monitor into process with pid 3360
2020-06-23 05:58:32,828 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x9fa00.
2020-06-23 05:58:32,828 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd0 amd local view 0x75D90000 to global list.
2020-06-23 05:58:32,875 [root] DEBUG: DLL unloaded from 0x75770000.
2020-06-23 05:58:33,000 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x77270000 to global list.
2020-06-23 05:58:33,000 [root] DEBUG: DLL loaded at 0x77270000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-23 05:58:33,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76DE0000 for section view with handle 0xf4.
2020-06-23 05:58:33,015 [root] DEBUG: DLL loaded at 0x76DE0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-23 05:58:33,015 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73D80000 for section view with handle 0xfc.
2020-06-23 05:58:33,031 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-23 05:58:33,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77540000 for section view with handle 0xf4.
2020-06-23 05:58:33,046 [root] DEBUG: DLL loaded at 0x77540000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes).
2020-06-23 05:58:33,062 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73BA0000 for section view with handle 0xfc.
2020-06-23 05:58:33,062 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 05:58:33,625 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x71960000 for section view with handle 0xfc.
2020-06-23 05:58:33,859 [root] DEBUG: DLL loaded at 0x71960000: C:\Windows\system32\MSVCP140 (0x71000 bytes).
2020-06-23 05:58:34,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x737D0000 for section view with handle 0xfc.
2020-06-23 05:58:34,078 [root] DEBUG: DLL loaded at 0x737D0000: C:\Windows\system32\VCRUNTIME140 (0x15000 bytes).
2020-06-23 05:58:34,109 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74DF0000 for section view with handle 0xfc.
2020-06-23 05:58:34,109 [root] DEBUG: DLL loaded at 0x74DF0000: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-06-23 05:58:34,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74D10000 for section view with handle 0xfc.
2020-06-23 05:58:34,140 [root] DEBUG: DLL loaded at 0x74D10000: C:\Windows\system32\ucrtbase (0xe0000 bytes).
2020-06-23 05:58:34,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CD0000 for section view with handle 0xfc.
2020-06-23 05:58:34,171 [root] DEBUG: DLL loaded at 0x74CD0000: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0 (0x3000 bytes).
2020-06-23 05:58:34,187 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CC0000 for section view with handle 0xfc.
2020-06-23 05:58:34,203 [root] DEBUG: DLL loaded at 0x74CC0000: C:\Windows\system32\api-ms-win-core-file-l2-1-0 (0x3000 bytes).
2020-06-23 05:58:34,249 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CB0000 for section view with handle 0xfc.
2020-06-23 05:58:34,265 [root] DEBUG: DLL loaded at 0x74CB0000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-06-23 05:58:34,281 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CA0000 for section view with handle 0xfc.
2020-06-23 05:58:34,281 [root] DEBUG: DLL loaded at 0x74CA0000: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1 (0x3000 bytes).
2020-06-23 05:58:34,281 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C90000 for section view with handle 0xfc.
2020-06-23 05:58:34,296 [root] DEBUG: DLL loaded at 0x74C90000: C:\Windows\system32\api-ms-win-core-file-l1-2-0 (0x3000 bytes).
2020-06-23 05:58:34,296 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C70000 for section view with handle 0xfc.
2020-06-23 05:58:34,312 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\api-ms-win-crt-string-l1-1-0 (0x4000 bytes).
2020-06-23 05:58:34,312 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C60000 for section view with handle 0xfc.
2020-06-23 05:58:34,312 [root] DEBUG: DLL loaded at 0x74C60000: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0 (0x3000 bytes).
2020-06-23 05:58:34,328 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C50000 for section view with handle 0xfc.
2020-06-23 05:58:34,343 [root] DEBUG: DLL loaded at 0x74C50000: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0 (0x4000 bytes).
2020-06-23 05:58:34,343 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C40000 for section view with handle 0xfc.
2020-06-23 05:58:34,343 [root] DEBUG: DLL loaded at 0x74C40000: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0 (0x4000 bytes).
2020-06-23 05:58:34,359 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C20000 for section view with handle 0xfc.
2020-06-23 05:58:34,375 [root] DEBUG: DLL loaded at 0x74C20000: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0 (0x3000 bytes).
2020-06-23 05:58:34,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C30000 for section view with handle 0xfc.
2020-06-23 05:58:34,390 [root] DEBUG: DLL loaded at 0x74C30000: C:\Windows\system32\api-ms-win-crt-math-l1-1-0 (0x5000 bytes).
2020-06-23 05:58:35,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x737C0000 for section view with handle 0xfc.
2020-06-23 05:58:36,562 [root] DEBUG: DLL loaded at 0x737C0000: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0 (0x5000 bytes).
2020-06-23 05:58:37,125 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C10000 for section view with handle 0xfc.
2020-06-23 05:58:37,140 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\api-ms-win-crt-time-l1-1-0 (0x3000 bytes).
2020-06-23 05:58:37,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74BD0000 for section view with handle 0xfc.
2020-06-23 05:58:37,156 [root] DEBUG: DLL loaded at 0x74BD0000: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0 (0x3000 bytes).
2020-06-23 05:58:37,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74BF0000 for section view with handle 0xfc.
2020-06-23 05:58:37,171 [root] DEBUG: DLL loaded at 0x74BF0000: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0 (0x3000 bytes).
2020-06-23 05:58:37,187 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74D00000 for section view with handle 0xfc.
2020-06-23 05:58:37,187 [root] DEBUG: DLL loaded at 0x74D00000: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0 (0x3000 bytes).
2020-06-23 05:58:37,203 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x734B0000 for section view with handle 0xfc.
2020-06-23 05:58:38,984 [root] DEBUG: DLL loaded at 0x734B0000: C:\Windows\system32\WINMM (0x32000 bytes).
2020-06-23 05:58:39,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x737B0000 for section view with handle 0xfc.
2020-06-23 05:58:39,000 [root] DEBUG: DLL loaded at 0x737B0000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2020-06-23 05:58:39,062 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x12c amd local view 0x71920000 to global list.
2020-06-23 05:58:39,062 [root] DEBUG: DLL loaded at 0x71920000: C:\Program Files (x86)\Mozilla Firefox\softokn3 (0x37000 bytes).
2020-06-23 05:58:39,078 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x718B0000 for section view with handle 0x12c.
2020-06-23 05:58:39,093 [root] DEBUG: DLL loaded at 0x718B0000: C:\Program Files (x86)\Mozilla Firefox\freebl3 (0x6f000 bytes).
2020-06-23 05:58:39,312 [root] DEBUG: DLL unloaded from 0x718B0000.
2020-06-23 05:58:39,312 [root] DEBUG: DLL unloaded from 0x71920000.
2020-06-23 05:58:39,343 [root] DEBUG: DLL unloaded from 0x734F0000.
2020-06-23 05:58:39,343 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-23 05:58:39,343 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-23 05:58:39,468 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-23 05:58:39,515 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-23 05:58:39,515 [root] DEBUG: DLL unloaded from 0x75AE0000.
2020-06-23 05:58:39,531 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-23 05:58:39,531 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-23 05:58:40,328 [root] DEBUG: DLL loaded at 0x73860000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-06-23 05:58:40,421 [root] DEBUG: set_caller_info: Adding region at 0x73860000 to caller regions list (ntdll::memcpy).
2020-06-23 05:58:40,421 [root] DEBUG: set_caller_info: Calling region at 0x73860000 skipped.
2020-06-23 05:58:40,437 [root] DEBUG: DLL unloaded from 0x75600000.
2020-06-23 05:58:47,843 [root] INFO: Announced starting service "b'VaultSvc'"
2020-06-23 05:58:47,859 [lib.api.process] INFO: Monitor config for process 472: C:\tmpt2nfl3rg\dll\472.ini
2020-06-23 05:58:47,859 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\EMOwNP.dll, loader C:\tmpt2nfl3rg\bin\dIBcekkC.exe
2020-06-23 05:58:47,890 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:58:47,906 [root] DEBUG: Loader: Injecting process 472 (thread 0) with C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:58:47,906 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFD4000 Local PEB 0x000007FFFFFDE000 Local TEB 0x000007FFFFFD3000: The operation completed successfully.
2020-06-23 05:58:47,921 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-23 05:58:47,921 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:58:47,937 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:58:47,937 [root] INFO: Disabling sleep skipping.
2020-06-23 05:58:47,937 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 472 at 0x0000000073620000, image base 0x00000000FFBB0000, stack from 0x00000000025C6000-0x00000000025D0000
2020-06-23 05:58:47,953 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe.
2020-06-23 05:58:47,984 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-23 05:58:48,031 [root] WARNING: b'Unable to hook LockResource'
2020-06-23 05:58:48,125 [root] INFO: Loaded monitor into process with pid 472
2020-06-23 05:58:48,125 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 05:58:48,140 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 05:58:48,140 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:58:49,218 [root] INFO: Announced 64-bit process name: lsass.exe pid: 1900
2020-06-23 05:58:49,234 [lib.api.process] INFO: Monitor config for process 1900: C:\tmpt2nfl3rg\dll\1900.ini
2020-06-23 05:58:49,249 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\EMOwNP.dll, loader C:\tmpt2nfl3rg\bin\dIBcekkC.exe
2020-06-23 05:58:49,249 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:58:49,281 [root] DEBUG: Loader: Injecting process 1900 (thread 2892) with C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:58:49,281 [root] DEBUG: Process image base: 0x00000000FF730000
2020-06-23 05:58:49,296 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:58:49,312 [root] DEBUG: InjectDllViaIAT: Failed to allocate region in target process for new import table.
2020-06-23 05:58:49,312 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-23 05:58:49,328 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:58:49,359 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:58:49,359 [root] INFO: Disabling sleep skipping.
2020-06-23 05:58:49,390 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 1900 at 0x0000000073620000, image base 0x00000000FF730000, stack from 0x0000000000394000-0x00000000003A0000
2020-06-23 05:58:49,390 [root] DEBUG: Commandline: C:\Windows\sysnative\lsass.exe.
2020-06-23 05:58:49,453 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-23 05:58:49,468 [root] WARNING: b'Unable to hook LockResource'
2020-06-23 05:58:49,484 [root] INFO: Loaded monitor into process with pid 1900
2020-06-23 05:58:49,515 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 05:58:49,531 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 05:58:49,562 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:58:49,609 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\system32\lsass.exe.
2020-06-23 05:58:49,609 [root] DEBUG: CreateProcessHandler: Injection info set for new process 1900, ImageBase: 0x00000000FF730000
2020-06-23 05:58:49,640 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 1900.
2020-06-23 05:59:19,656 [root] INFO: Process with pid 1900 has terminated
2020-06-23 05:59:19,687 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 3360).
2020-06-23 05:59:20,265 [root] DEBUG: DLL loaded at 0x74A70000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-23 05:59:21,125 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x158 amd local view 0x734E0000 to global list.
2020-06-23 05:59:21,312 [root] DEBUG: DLL loaded at 0x734E0000: C:\Program Files (x86)\Mozilla Thunderbird\nss3 (0x134000 bytes).
2020-06-23 05:59:21,515 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73830000 for section view with handle 0x158.
2020-06-23 05:59:21,531 [root] DEBUG: DLL loaded at 0x73830000: C:\Program Files (x86)\Mozilla Thunderbird\mozglue (0x24000 bytes).
2020-06-23 05:59:21,578 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73BA0000 for section view with handle 0x158.
2020-06-23 05:59:21,578 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 05:59:21,609 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73D80000 for section view with handle 0x158.
2020-06-23 05:59:21,609 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-23 05:59:21,671 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x737B0000 for section view with handle 0x158.
2020-06-23 05:59:21,671 [root] DEBUG: DLL loaded at 0x737B0000: C:\Windows\system32\MSVCP140 (0x71000 bytes).
2020-06-23 05:59:21,687 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x734C0000 for section view with handle 0x158.
2020-06-23 05:59:21,687 [root] DEBUG: DLL loaded at 0x734C0000: C:\Windows\system32\VCRUNTIME140 (0x15000 bytes).
2020-06-23 05:59:21,703 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74DF0000 for section view with handle 0x158.
2020-06-23 05:59:21,703 [root] DEBUG: DLL loaded at 0x74DF0000: C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:21,703 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74D10000 for section view with handle 0x158.
2020-06-23 05:59:21,703 [root] DEBUG: DLL loaded at 0x74D10000: C:\Windows\system32\ucrtbase (0xe0000 bytes).
2020-06-23 05:59:21,718 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CD0000 for section view with handle 0x158.
2020-06-23 05:59:21,718 [root] DEBUG: DLL loaded at 0x74CD0000: C:\Windows\system32\api-ms-win-core-timezone-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:21,718 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CC0000 for section view with handle 0x158.
2020-06-23 05:59:21,734 [root] DEBUG: DLL loaded at 0x74CC0000: C:\Windows\system32\api-ms-win-core-file-l2-1-0 (0x3000 bytes).
2020-06-23 05:59:21,734 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CB0000 for section view with handle 0x158.
2020-06-23 05:59:21,734 [root] DEBUG: DLL loaded at 0x74CB0000: C:\Windows\system32\api-ms-win-core-localization-l1-2-0 (0x3000 bytes).
2020-06-23 05:59:21,734 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CA0000 for section view with handle 0x158.
2020-06-23 05:59:21,750 [root] DEBUG: DLL loaded at 0x74CA0000: C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1 (0x3000 bytes).
2020-06-23 05:59:21,750 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C90000 for section view with handle 0x158.
2020-06-23 05:59:21,750 [root] DEBUG: DLL loaded at 0x74C90000: C:\Windows\system32\api-ms-win-core-file-l1-2-0 (0x3000 bytes).
2020-06-23 05:59:21,765 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C70000 for section view with handle 0x158.
2020-06-23 05:59:21,765 [root] DEBUG: DLL loaded at 0x74C70000: C:\Windows\system32\api-ms-win-crt-string-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:21,765 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C60000 for section view with handle 0x158.
2020-06-23 05:59:21,765 [root] DEBUG: DLL loaded at 0x74C60000: C:\Windows\system32\api-ms-win-crt-heap-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:21,781 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C50000 for section view with handle 0x158.
2020-06-23 05:59:21,781 [root] DEBUG: DLL loaded at 0x74C50000: C:\Windows\system32\api-ms-win-crt-stdio-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:21,781 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C40000 for section view with handle 0x158.
2020-06-23 05:59:21,781 [root] DEBUG: DLL loaded at 0x74C40000: C:\Windows\system32\api-ms-win-crt-convert-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:21,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C20000 for section view with handle 0x158.
2020-06-23 05:59:21,796 [root] DEBUG: DLL loaded at 0x74C20000: C:\Windows\system32\api-ms-win-crt-locale-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:21,796 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C30000 for section view with handle 0x158.
2020-06-23 05:59:21,796 [root] DEBUG: DLL loaded at 0x74C30000: C:\Windows\system32\api-ms-win-crt-math-l1-1-0 (0x5000 bytes).
2020-06-23 05:59:21,812 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x737A0000 for section view with handle 0x158.
2020-06-23 05:59:21,812 [root] DEBUG: DLL loaded at 0x737A0000: C:\Windows\system32\api-ms-win-crt-multibyte-l1-1-0 (0x5000 bytes).
2020-06-23 05:59:21,812 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C10000 for section view with handle 0x158.
2020-06-23 05:59:21,828 [root] DEBUG: DLL loaded at 0x74C10000: C:\Windows\system32\api-ms-win-crt-time-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:21,828 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74BD0000 for section view with handle 0x158.
2020-06-23 05:59:21,828 [root] DEBUG: DLL loaded at 0x74BD0000: C:\Windows\system32\api-ms-win-crt-filesystem-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:21,828 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74BF0000 for section view with handle 0x158.
2020-06-23 05:59:21,859 [root] DEBUG: DLL loaded at 0x74BF0000: C:\Windows\system32\api-ms-win-crt-environment-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:21,859 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74D00000 for section view with handle 0x158.
2020-06-23 05:59:21,859 [root] DEBUG: DLL loaded at 0x74D00000: C:\Windows\system32\api-ms-win-crt-utility-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:22,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x719A0000 for section view with handle 0x158.
2020-06-23 05:59:22,031 [root] DEBUG: set_caller_info: Adding region at 0x737B0000 to caller regions list (ntdll::LdrLoadDll).
2020-06-23 05:59:22,031 [root] DEBUG: set_caller_info: Calling region at 0x737B0000 skipped.
2020-06-23 05:59:22,093 [root] DEBUG: DLL loaded at 0x719A0000: C:\Windows\system32\WINMM (0x32000 bytes).
2020-06-23 05:59:22,109 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x734B0000 for section view with handle 0x158.
2020-06-23 05:59:22,109 [root] DEBUG: DLL loaded at 0x734B0000: C:\Windows\system32\WSOCK32 (0x7000 bytes).
2020-06-23 05:59:22,187 [root] DEBUG: DLL unloaded from 0x734E0000.
2020-06-23 05:59:22,187 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-23 05:59:22,187 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-23 05:59:22,281 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-23 05:59:22,281 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-23 05:59:22,281 [root] DEBUG: DLL unloaded from 0x75AE0000.
2020-06-23 05:59:22,281 [root] DEBUG: DLL unloaded from 0x75350000.
2020-06-23 05:59:22,281 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-23 05:59:22,765 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x164 amd local view 0x74CE0000 to global list.
2020-06-23 05:59:22,765 [root] DEBUG: DLL loaded at 0x73850000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-06-23 05:59:22,765 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2020-06-23 05:59:22,765 [root] DEBUG: DLL loaded at 0x74CE0000: C:\Windows\system32\NETAPI32 (0x11000 bytes).
2020-06-23 05:59:22,781 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C80000 for section view with handle 0x164.
2020-06-23 05:59:22,781 [root] DEBUG: DLL loaded at 0x74C80000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-23 05:59:22,781 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74B00000 for section view with handle 0x164.
2020-06-23 05:59:22,781 [root] DEBUG: DLL loaded at 0x74B00000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-06-23 05:59:22,796 [root] DEBUG: DLL loaded at 0x73830000: C:\Windows\system32\SAMLIB (0x12000 bytes).
2020-06-23 05:59:22,812 [root] DEBUG: DLL loaded at 0x74AD0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-06-23 05:59:22,828 [root] DEBUG: DLL loaded at 0x77270000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-23 05:59:22,828 [root] DEBUG: DLL loaded at 0x76DE0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-23 05:59:22,843 [root] DEBUG: DLL loaded at 0x74A90000: C:\Windows\System32\mswsock (0x3c000 bytes).
2020-06-23 05:59:22,859 [root] DEBUG: DLL loaded at 0x737E0000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-06-23 05:59:22,859 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-06-23 05:59:22,859 [root] DEBUG: DLL loaded at 0x74EA0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-06-23 05:59:23,546 [root] DEBUG: DLL loaded at 0x737A0000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2020-06-23 05:59:23,546 [root] DEBUG: DLL loaded at 0x73610000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-06-23 05:59:23,562 [root] DEBUG: DLL loaded at 0x73600000: C:\Windows\System32\wship6 (0x6000 bytes).
2020-06-23 05:59:23,562 [root] DEBUG: DLL loaded at 0x74A80000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-06-23 05:59:24,484 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 3248
2020-06-23 05:59:24,500 [lib.api.process] INFO: Monitor config for process 3248: C:\tmpt2nfl3rg\dll\3248.ini
2020-06-23 05:59:24,531 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:59:24,562 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:24,562 [root] DEBUG: Loader: Injecting process 3248 (thread 2412) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:24,593 [root] DEBUG: Process image base: 0x00360000
2020-06-23 05:59:24,593 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:24,609 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 05:59:24,609 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:24,609 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3248
2020-06-23 05:59:24,640 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc.
2020-06-23 05:59:24,656 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3248, ImageBase: 0x0000000000360000
2020-06-23 05:59:24,671 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 3248
2020-06-23 05:59:24,671 [lib.api.process] INFO: Monitor config for process 3248: C:\tmpt2nfl3rg\dll\3248.ini
2020-06-23 05:59:24,687 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:59:24,718 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:24,734 [root] DEBUG: Loader: Injecting process 3248 (thread 2412) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:24,734 [root] DEBUG: Process image base: 0x00360000
2020-06-23 05:59:24,734 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:24,765 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
2020-06-23 05:59:24,765 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-23 05:59:24,812 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:24,843 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3248
2020-06-23 05:59:24,859 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3248.
2020-06-23 05:59:24,890 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:59:24,968 [root] INFO: Loaded monitor into process with pid 3248
2020-06-23 05:59:25,000 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xec amd local view 0x741E0000 to global list.
2020-06-23 05:59:25,000 [root] DEBUG: DLL loaded at 0x741E0000: C:\Program Files (x86)\Google\Update\1.3.35.451\goopdate (0x1c6000 bytes).
2020-06-23 05:59:25,015 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe8 amd local view 0x75560000 to global list.
2020-06-23 05:59:25,015 [root] DEBUG: DLL loaded at 0x75560000: C:\Windows\syswow64\OLEAUT32 (0x91000 bytes).
2020-06-23 05:59:25,015 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74EB0000 for section view with handle 0xec.
2020-06-23 05:59:25,031 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-06-23 05:59:25,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77140000 for section view with handle 0xe8.
2020-06-23 05:59:25,031 [root] DEBUG: DLL loaded at 0x77140000: C:\Windows\syswow64\NSI (0x6000 bytes).
2020-06-23 05:59:25,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74EA0000 for section view with handle 0xec.
2020-06-23 05:59:25,046 [root] DEBUG: DLL loaded at 0x74EA0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-06-23 05:59:25,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74470000 for section view with handle 0xec.
2020-06-23 05:59:25,046 [root] DEBUG: DLL loaded at 0x74470000: C:\Windows\system32\msi (0x246000 bytes).
2020-06-23 05:59:25,046 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CE0000 for section view with handle 0xec.
2020-06-23 05:59:25,046 [root] DEBUG: DLL loaded at 0x73850000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-06-23 05:59:25,062 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2020-06-23 05:59:25,062 [root] DEBUG: DLL loaded at 0x74CE0000: C:\Windows\system32\NETAPI32 (0x11000 bytes).
2020-06-23 05:59:25,062 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C80000 for section view with handle 0xec.
2020-06-23 05:59:25,062 [root] DEBUG: DLL loaded at 0x74C80000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-23 05:59:25,078 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74B00000 for section view with handle 0xec.
2020-06-23 05:59:25,078 [root] DEBUG: DLL loaded at 0x74B00000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-06-23 05:59:25,078 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73D80000 for section view with handle 0xec.
2020-06-23 05:59:25,078 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-23 05:59:25,093 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74AD0000 for section view with handle 0xec.
2020-06-23 05:59:25,093 [root] DEBUG: DLL loaded at 0x74AD0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-06-23 05:59:25,093 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74A70000 for section view with handle 0xec.
2020-06-23 05:59:25,109 [root] DEBUG: DLL loaded at 0x74A70000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-23 05:59:25,109 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74A40000 for section view with handle 0xec.
2020-06-23 05:59:25,109 [root] DEBUG: DLL loaded at 0x74A40000: C:\Windows\system32\WTSAPI32 (0xd000 bytes).
2020-06-23 05:59:25,125 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x10c amd local view 0x74040000 to global list.
2020-06-23 05:59:25,125 [root] DEBUG: DLL loaded at 0x74040000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32 (0x19e000 bytes).
2020-06-23 05:59:25,125 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77270000 for section view with handle 0xec.
2020-06-23 05:59:25,125 [root] DEBUG: DLL loaded at 0x77270000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-23 05:59:25,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76DE0000 for section view with handle 0xec.
2020-06-23 05:59:25,140 [root] DEBUG: DLL loaded at 0x76DE0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-23 05:59:25,156 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x128 amd local view 0x74A30000 to global list.
2020-06-23 05:59:25,156 [root] DEBUG: DLL loaded at 0x74A30000: C:\Windows\system32\MSIMG32 (0x5000 bytes).
2020-06-23 05:59:25,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x743F0000 for section view with handle 0x128.
2020-06-23 05:59:25,171 [root] DEBUG: DLL loaded at 0x743F0000: C:\Windows\system32\UxTheme (0x80000 bytes).
2020-06-23 05:59:25,171 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75900000 for section view with handle 0xec.
2020-06-23 05:59:25,187 [root] DEBUG: DLL loaded at 0x75900000: C:\Windows\syswow64\WININET (0x1c4000 bytes).
2020-06-23 05:59:25,187 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76F10000 for section view with handle 0xec.
2020-06-23 05:59:25,187 [root] DEBUG: DLL loaded at 0x76F10000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:25,187 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75700000 for section view with handle 0xec.
2020-06-23 05:59:25,203 [root] DEBUG: DLL loaded at 0x75700000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:25,203 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x754A0000 for section view with handle 0xec.
2020-06-23 05:59:25,203 [root] DEBUG: DLL loaded at 0x754A0000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:25,203 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x756F0000 for section view with handle 0xec.
2020-06-23 05:59:25,203 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:25,203 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75AD0000 for section view with handle 0xec.
2020-06-23 05:59:25,203 [root] DEBUG: DLL loaded at 0x75AD0000: C:\Windows\syswow64\normaliz (0x3000 bytes).
2020-06-23 05:59:25,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x769F0000 for section view with handle 0xec.
2020-06-23 05:59:25,218 [root] DEBUG: DLL loaded at 0x769F0000: C:\Windows\syswow64\iertutil (0x215000 bytes).
2020-06-23 05:59:25,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76DF0000 for section view with handle 0xec.
2020-06-23 05:59:25,234 [root] DEBUG: DLL loaded at 0x76DF0000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-06-23 05:59:25,234 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77540000 for section view with handle 0xec.
2020-06-23 05:59:25,234 [root] DEBUG: DLL loaded at 0x77540000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes).
2020-06-23 05:59:25,249 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x150 amd local view 0x027A0000 to global list.
2020-06-23 05:59:25,265 [root] DEBUG: DLL unloaded from 0x00360000.
2020-06-23 05:59:25,265 [root] DEBUG: DLL unloaded from 0x741E0000.
2020-06-23 05:59:25,281 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-23 05:59:25,281 [root] DEBUG: DLL loaded at 0x76C10000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2020-06-23 05:59:25,296 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 05:59:25,296 [root] DEBUG: DLL unloaded from 0x73BA0000.
2020-06-23 05:59:25,312 [root] DEBUG: DLL unloaded from 0x75600000.
2020-06-23 05:59:25,328 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 05:59:25,328 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x194 amd local view 0x00120000 to global list.
2020-06-23 05:59:25,390 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 3248).
2020-06-23 05:59:25,468 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 3248).
2020-06-23 05:59:25,484 [root] DEBUG: DLL loaded at 0x77150000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-23 05:59:25,500 [root] DEBUG: DLL loaded at 0x74A50000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-23 05:59:25,500 [root] DEBUG: DLL loaded at 0x748F0000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-23 05:59:25,515 [root] DEBUG: DLL loaded at 0x74010000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-06-23 05:59:25,531 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x22c amd local view 0x735B0000 to global list.
2020-06-23 05:59:25,531 [root] DEBUG: DLL loaded at 0x735B0000: C:\Program Files (x86)\Google\Update\1.3.35.451\psmachine (0x42000 bytes).
2020-06-23 05:59:25,609 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3456, handle 0x244.
2020-06-23 05:59:25,609 [root] DEBUG: Error 5 (0x5) - OpenProcessHandler: Error obtaining target process name: Access is denied.
2020-06-23 05:59:25,734 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:25,734 [root] DEBUG: DLL unloaded from 0x00360000.
2020-06-23 05:59:25,750 [root] DEBUG: DLL loaded at 0x718A0000: C:\Windows\System32\msxml3 (0x134000 bytes).
2020-06-23 05:59:25,750 [root] DEBUG: DLL loaded at 0x74E00000: C:\Windows\System32\bcrypt (0x17000 bytes).
2020-06-23 05:59:25,765 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:25,781 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x298 amd local view 0x73550000 to global list.
2020-06-23 05:59:25,796 [root] DEBUG: DLL loaded at 0x73550000: C:\Windows\system32\winhttp (0x58000 bytes).
2020-06-23 05:59:25,828 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73500000 for section view with handle 0x298.
2020-06-23 05:59:25,843 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
2020-06-23 05:59:25,843 [root] DEBUG: DLL loaded at 0x73500000: C:\Windows\system32\webio (0x50000 bytes).
2020-06-23 05:59:25,906 [root] DEBUG: DLL loaded at 0x773A0000: C:\Windows\syswow64\WS2_32 (0x35000 bytes).
2020-06-23 05:59:25,921 [root] DEBUG: DLL unloaded from 0x76E00000.
2020-06-23 05:59:25,937 [root] DEBUG: DLL loaded at 0x734F0000: C:\Windows\system32\credssp (0x8000 bytes).
2020-06-23 05:59:25,937 [root] DEBUG: DLL unloaded from 0x74A50000.
2020-06-23 05:59:25,937 [root] DEBUG: DLL loaded at 0x734E0000: C:\Windows\system32\dhcpcsvc6 (0xd000 bytes).
2020-06-23 05:59:25,953 [root] DEBUG: DLL loaded at 0x734C0000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2020-06-23 05:59:25,953 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:25,968 [root] DEBUG: DLL loaded at 0x75470000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2020-06-23 05:59:25,984 [root] DEBUG: DLL loaded at 0x74A90000: C:\Windows\system32\mswsock (0x3c000 bytes).
2020-06-23 05:59:26,000 [root] DEBUG: DLL loaded at 0x74A80000: C:\Windows\System32\wshtcpip (0x5000 bytes).
2020-06-23 05:59:26,000 [root] DEBUG: DLL loaded at 0x73600000: C:\Windows\System32\wship6 (0x6000 bytes).
2020-06-23 05:59:26,000 [root] DEBUG: DLL unloaded from 0x73550000.
2020-06-23 05:59:26,015 [root] DEBUG: DLL loaded at 0x737E0000: C:\Windows\system32\DNSAPI (0x44000 bytes).
2020-06-23 05:59:26,015 [root] DEBUG: DLL loaded at 0x734B0000: C:\Windows\system32\NLAapi (0x10000 bytes).
2020-06-23 05:59:26,015 [root] DEBUG: DLL loaded at 0x734A0000: C:\Windows\system32\napinsp (0x10000 bytes).
2020-06-23 05:59:26,031 [root] DEBUG: DLL loaded at 0x71880000: C:\Windows\system32\pnrpnsp (0x12000 bytes).
2020-06-23 05:59:26,031 [root] DEBUG: DLL loaded at 0x73490000: C:\Windows\System32\winrnr (0x8000 bytes).
2020-06-23 05:59:26,031 [root] DEBUG: DLL loaded at 0x73610000: C:\Windows\system32\rasadhlp (0x6000 bytes).
2020-06-23 05:59:26,031 [root] DEBUG: DLL loaded at 0x737A0000: C:\Windows\System32\fwpuclnt (0x38000 bytes).
2020-06-23 05:59:26,453 [root] DEBUG: DLL loaded at 0x71830000: C:\Windows\SysWOW64\schannel (0x41000 bytes).
2020-06-23 05:59:27,640 [root] DEBUG: DLL loaded at 0x71820000: C:\Windows\system32\secur32 (0x8000 bytes).
2020-06-23 05:59:27,640 [root] DEBUG: DLL loaded at 0x717E0000: C:\Windows\system32\ncrypt (0x39000 bytes).
2020-06-23 05:59:27,656 [root] DEBUG: DLL loaded at 0x717A0000: C:\Windows\SysWOW64\bcryptprimitives (0x3d000 bytes).
2020-06-23 05:59:27,718 [root] DEBUG: DLL loaded at 0x71780000: C:\Windows\system32\GPAPI (0x16000 bytes).
2020-06-23 05:59:27,765 [root] DEBUG: DLL loaded at 0x73A00000: C:\Windows\system32\WINSTA (0x29000 bytes).
2020-06-23 05:59:28,437 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:28,437 [root] DEBUG: DLL unloaded from 0x00360000.
2020-06-23 05:59:28,453 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:28,500 [root] DEBUG: DLL unloaded from 0x00360000.
2020-06-23 05:59:28,546 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3248, handle 0x3f0.
2020-06-23 05:59:28,546 [root] INFO: Stopping BITS Service
2020-06-23 05:59:31,453 [root] INFO: Stopped BITS Service
2020-06-23 05:59:31,796 [lib.api.process] INFO: Monitor config for process 588: C:\tmpt2nfl3rg\dll\588.ini
2020-06-23 05:59:31,796 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\EMOwNP.dll, loader C:\tmpt2nfl3rg\bin\dIBcekkC.exe
2020-06-23 05:59:31,828 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:31,828 [root] DEBUG: Loader: Injecting process 588 (thread 0) with C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:31,828 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFD8000 Local PEB 0x000007FFFFFDE000 Local TEB 0x000007FFFFFDD000: The operation completed successfully.
2020-06-23 05:59:31,859 [root] DEBUG: Error 299 (0x12b) - GetProcessInitialThreadId: Failed to read from process: Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
2020-06-23 05:59:31,875 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-23 05:59:31,890 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:59:31,890 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:59:31,890 [root] INFO: Disabling sleep skipping.
2020-06-23 05:59:31,937 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 588 at 0x0000000073620000, image base 0x00000000FFC60000, stack from 0x0000000001D56000-0x0000000001D60000
2020-06-23 05:59:31,937 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k DcomLaunch.
2020-06-23 05:59:32,000 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-23 05:59:32,000 [root] WARNING: b'Unable to hook LockResource'
2020-06-23 05:59:32,015 [root] INFO: Loaded monitor into process with pid 588
2020-06-23 05:59:32,015 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 05:59:32,015 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 05:59:32,015 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:34,046 [root] INFO: Starting BITS Service
2020-06-23 05:59:34,156 [root] INFO: Announced 64-bit process name: svchost.exe pid: 3996
2020-06-23 05:59:34,156 [lib.api.process] INFO: Monitor config for process 3996: C:\tmpt2nfl3rg\dll\3996.ini
2020-06-23 05:59:34,156 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\EMOwNP.dll, loader C:\tmpt2nfl3rg\bin\dIBcekkC.exe
2020-06-23 05:59:34,187 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:34,187 [root] DEBUG: Loader: Injecting process 3996 (thread 4024) with C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:34,187 [root] DEBUG: Process image base: 0x00000000FFC60000
2020-06-23 05:59:34,187 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:34,203 [root] DEBUG: InjectDllViaIAT: Failed to allocate region in target process for new import table.
2020-06-23 05:59:34,203 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-23 05:59:34,218 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:59:34,218 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:59:34,218 [root] INFO: Disabling sleep skipping.
2020-06-23 05:59:34,234 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 3996 at 0x0000000073620000, image base 0x00000000FFC60000, stack from 0x00000000002E6000-0x00000000002F0000
2020-06-23 05:59:34,234 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-23 05:59:34,265 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-23 05:59:34,265 [root] WARNING: b'Unable to hook LockResource'
2020-06-23 05:59:34,281 [root] INFO: Loaded monitor into process with pid 3996
2020-06-23 05:59:34,281 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 05:59:34,281 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 05:59:34,312 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:34,421 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\System32\svchost.exe -k netsvcs.
2020-06-23 05:59:34,421 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3996, ImageBase: 0x00000000FFC60000
2020-06-23 05:59:34,437 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 3996.
2020-06-23 05:59:34,500 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\System32\CRYPTBASE (0xf000 bytes).
2020-06-23 05:59:34,531 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 3996).
2020-06-23 05:59:34,562 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3996, handle 0x5e0.
2020-06-23 05:59:34,562 [root] DEBUG: DLL loaded at 0x000007FEFF840000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2020-06-23 05:59:34,593 [root] DEBUG: DLL loaded at 0x000007FEFEC40000: C:\Windows\system32\OLEAUT32 (0xda000 bytes).
2020-06-23 05:59:34,671 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 3996
2020-06-23 05:59:34,671 [root] DEBUG: GetHookCallerBase: thread 4024 (handle 0x0), return address 0x00000000FFC632CF, allocation base 0x00000000FFC60000.
2020-06-23 05:59:34,671 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FFC60000.
2020-06-23 05:59:34,703 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 05:59:34,703 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FFC60000.
2020-06-23 05:59:34,703 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000246C.
2020-06-23 05:59:34,765 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x6800.
2020-06-23 05:59:34,828 [root] DEBUG: DLL unloaded from 0x000007FEFEFD0000.
2020-06-23 05:59:34,843 [root] INFO: Process with pid 3996 has terminated
2020-06-23 05:59:34,859 [root] INFO: Process with pid 3996 has terminated
2020-06-23 05:59:34,890 [root] INFO: Started BITS Service
2020-06-23 05:59:34,921 [root] DEBUG: DLL unloaded from 0x000007FEFF500000.
2020-06-23 05:59:35,296 [root] INFO: Announced starting service "b'BITS'"
2020-06-23 05:59:35,312 [root] INFO: Announced 64-bit process name: svchost.exe pid: 1316
2020-06-23 05:59:35,312 [lib.api.process] INFO: Monitor config for process 1316: C:\tmpt2nfl3rg\dll\1316.ini
2020-06-23 05:59:35,312 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\EMOwNP.dll, loader C:\tmpt2nfl3rg\bin\dIBcekkC.exe
2020-06-23 05:59:35,328 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:35,328 [root] DEBUG: Loader: Injecting process 1316 (thread 4120) with C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:35,328 [root] DEBUG: Process image base: 0x00000000FFC60000
2020-06-23 05:59:35,343 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:35,343 [root] DEBUG: InjectDllViaIAT: Failed to allocate region in target process for new import table.
2020-06-23 05:59:35,359 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-23 05:59:35,375 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:59:35,375 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:59:35,375 [root] INFO: Disabling sleep skipping.
2020-06-23 05:59:35,375 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 1316 at 0x0000000073620000, image base 0x00000000FFC60000, stack from 0x0000000000306000-0x0000000000310000
2020-06-23 05:59:35,375 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-23 05:59:35,421 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-23 05:59:35,421 [root] WARNING: b'Unable to hook LockResource'
2020-06-23 05:59:35,421 [root] INFO: Loaded monitor into process with pid 1316
2020-06-23 05:59:35,421 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 05:59:35,437 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 05:59:35,468 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:35,484 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\System32\svchost.exe -k netsvcs.
2020-06-23 05:59:35,500 [root] DEBUG: CreateProcessHandler: Injection info set for new process 1316, ImageBase: 0x00000000FFC60000
2020-06-23 05:59:35,562 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1316, handle 0x30c.
2020-06-23 05:59:35,562 [root] DEBUG: DLL loaded at 0x000007FEFF840000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2020-06-23 05:59:35,578 [root] DEBUG: DLL loaded at 0x000007FEFEC40000: C:\Windows\system32\OLEAUT32 (0xda000 bytes).
2020-06-23 05:59:35,578 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 1316
2020-06-23 05:59:35,578 [root] DEBUG: GetHookCallerBase: thread 4120 (handle 0x0), return address 0x00000000FFC632CF, allocation base 0x00000000FFC60000.
2020-06-23 05:59:35,578 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FFC60000.
2020-06-23 05:59:35,578 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 05:59:35,578 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FFC60000.
2020-06-23 05:59:35,593 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000246C.
2020-06-23 05:59:35,609 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x6800.
2020-06-23 05:59:35,703 [root] DEBUG: DLL unloaded from 0x000007FEFEFD0000.
2020-06-23 05:59:35,703 [root] INFO: Process with pid 1316 has terminated
2020-06-23 05:59:35,718 [root] INFO: Process with pid 1316 has terminated
2020-06-23 05:59:35,750 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:35,750 [root] DEBUG: DLL unloaded from 0x00360000.
2020-06-23 05:59:35,812 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:36,968 [root] INFO: Announced starting service "b'BITS'"
2020-06-23 05:59:37,000 [root] INFO: Announced 64-bit process name: svchost.exe pid: 2596
2020-06-23 05:59:37,000 [lib.api.process] INFO: Monitor config for process 2596: C:\tmpt2nfl3rg\dll\2596.ini
2020-06-23 05:59:37,046 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\EMOwNP.dll, loader C:\tmpt2nfl3rg\bin\dIBcekkC.exe
2020-06-23 05:59:37,062 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:37,062 [root] DEBUG: Loader: Injecting process 2596 (thread 624) with C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:37,078 [root] DEBUG: Process image base: 0x00000000FFC60000
2020-06-23 05:59:37,078 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:37,078 [root] DEBUG: InjectDllViaIAT: Failed to allocate region in target process for new import table.
2020-06-23 05:59:37,078 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-23 05:59:37,093 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:59:37,109 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:59:37,109 [root] INFO: Disabling sleep skipping.
2020-06-23 05:59:37,109 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 2596 at 0x0000000073620000, image base 0x00000000FFC60000, stack from 0x0000000000336000-0x0000000000340000
2020-06-23 05:59:37,125 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-23 05:59:37,156 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-23 05:59:37,156 [root] WARNING: b'Unable to hook LockResource'
2020-06-23 05:59:37,171 [root] INFO: Loaded monitor into process with pid 2596
2020-06-23 05:59:37,171 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 05:59:37,171 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 05:59:37,171 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 05:59:37,203 [root] DEBUG: CreateProcessHandler: using lpCommandLine: C:\Windows\System32\svchost.exe -k netsvcs.
2020-06-23 05:59:37,203 [root] DEBUG: CreateProcessHandler: Injection info set for new process 2596, ImageBase: 0x00000000FFC60000
2020-06-23 05:59:37,218 [root] DEBUG: ResumeThreadHandler: Dumping section view for process 2596.
2020-06-23 05:59:37,234 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\System32\CRYPTBASE (0xf000 bytes).
2020-06-23 05:59:37,265 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 2596).
2020-06-23 05:59:37,265 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2596, handle 0x3e4.
2020-06-23 05:59:37,281 [root] DEBUG: DLL loaded at 0x000007FEFF840000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2020-06-23 05:59:37,281 [root] DEBUG: DLL loaded at 0x000007FEFEC40000: C:\Windows\system32\OLEAUT32 (0xda000 bytes).
2020-06-23 05:59:37,281 [root] DEBUG: NtTerminateProcess hook: Attempting to dump process 2596
2020-06-23 05:59:37,296 [root] DEBUG: GetHookCallerBase: thread 624 (handle 0x0), return address 0x00000000FFC632CF, allocation base 0x00000000FFC60000.
2020-06-23 05:59:37,296 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FFC60000.
2020-06-23 05:59:37,296 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 05:59:37,296 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00000000FFC60000.
2020-06-23 05:59:37,359 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000246C.
2020-06-23 05:59:37,406 [root] DEBUG: DLL unloaded from 0x73550000.
2020-06-23 05:59:42,515 [root] INFO: Added new file to list with pid None and path C:\Users\Louise\AppData\Local\Temp\{451D95A8-DB86-40A5-9A81-678C947DCCC9}-GoogleUpdateSetup.exe
2020-06-23 05:59:42,531 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.35.452\GoogleUpdateSetup.exe
2020-06-23 05:59:42,734 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:42,953 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\Install\{26FAD9E2-9546-4920-A06C-6EBFB87AF4DF}\GoogleUpdateSetup.exe
2020-06-23 05:59:44,921 [root] INFO: Announced 32-bit process name: GoogleUpdateSetup.exe pid: 4936
2020-06-23 05:59:44,921 [lib.api.process] INFO: Monitor config for process 4936: C:\tmpt2nfl3rg\dll\4936.ini
2020-06-23 05:59:44,968 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:59:45,015 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:45,140 [root] DEBUG: Loader: Injecting process 4936 (thread 3868) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:45,140 [root] DEBUG: Process image base: 0x003F0000
2020-06-23 05:59:45,140 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:45,187 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 05:59:45,187 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:45,187 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4936
2020-06-23 05:59:45,249 [root] DEBUG: DLL loaded at 0x75300000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-23 05:59:45,546 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Program Files (x86)\Google\Update\Install\{26FAD9E2-9546-4920-A06C-6EBFB87AF4DF}\GoogleUpdateSetup.exe" /update /sessionid "{FA04A27E-D95E-4D44-80EB-05C8E924CC34}".
2020-06-23 05:59:45,656 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 248, handle 0x5ec.
2020-06-23 05:59:45,703 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:59:45,703 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 328, handle 0x5ec.
2020-06-23 05:59:45,750 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:59:45,796 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 376, handle 0x5ec.
2020-06-23 05:59:45,921 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 384, handle 0x5ec.
2020-06-23 05:59:46,109 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1416, handle 0x5ec.
2020-06-23 05:59:46,109 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1424, handle 0x5ec.
2020-06-23 05:59:48,984 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:49,109 [root] DEBUG: DLL unloaded from 0x00360000.
2020-06-23 05:59:49,125 [root] DEBUG: DLL loaded at 0x713B0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-06-23 05:59:49,187 [root] DEBUG: DLL loaded at 0x75B30000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2020-06-23 05:59:49,203 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 4552
2020-06-23 05:59:49,203 [lib.api.process] INFO: Monitor config for process 4552: C:\tmpt2nfl3rg\dll\4552.ini
2020-06-23 05:59:49,203 [root] DEBUG: DLL loaded at 0x77120000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2020-06-23 05:59:49,500 [root] DEBUG: DLL unloaded from 0x75D90000.
2020-06-23 05:59:49,562 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:59:49,625 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:49,671 [root] DEBUG: Loader: Injecting process 4552 (thread 1068) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:49,671 [root] DEBUG: Process image base: 0x00360000
2020-06-23 05:59:49,812 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:49,968 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 05:59:50,031 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:50,109 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 4552
2020-06-23 05:59:50,156 [root] DEBUG: CreateProcessHandler: Injection info set for new process 4552, ImageBase: 0x00360000
2020-06-23 05:59:50,453 [root] INFO: Loaded monitor into process with pid 4552
2020-06-23 05:59:50,765 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 05:59:50,828 [root] DEBUG: DLL loaded at 0x73A00000: C:\Windows\system32\WINSTA (0x29000 bytes).
2020-06-23 05:59:50,890 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 4552, handle 0x1d0.
2020-06-23 05:59:51,015 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 248, handle 0x1d0.
2020-06-23 05:59:51,062 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 328, handle 0x1d0.
2020-06-23 05:59:51,265 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 376, handle 0x1d0.
2020-06-23 05:59:51,468 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 384, handle 0x1d0.
2020-06-23 05:59:51,781 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1040, handle 0x1d0.
2020-06-23 05:59:51,906 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1104, handle 0x1d0.
2020-06-23 05:59:52,046 [root] DEBUG: DLL loaded at 0x734F0000: C:\Windows\system32\credssp (0x8000 bytes).
2020-06-23 05:59:52,109 [root] DEBUG: DLL loaded at 0x734C0000: C:\Windows\system32\dhcpcsvc (0x12000 bytes).
2020-06-23 05:59:52,125 [root] DEBUG: DLL unloaded from 0x77990000.
2020-06-23 05:59:52,312 [root] DEBUG: DLL loaded at 0x75470000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2020-06-23 05:59:52,468 [root] DEBUG: DLL loaded at 0x74A90000: C:\Windows\system32\mswsock (0x3c000 bytes).
2020-06-23 05:59:52,640 [root] DEBUG: DLL loaded at 0x71830000: C:\Windows\SysWOW64\schannel (0x41000 bytes).
2020-06-23 05:59:53,546 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateSetup.exe
2020-06-23 05:59:53,562 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xf4 amd local view 0x03820000 to global list.
2020-06-23 05:59:53,562 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x100 amd local view 0x03A60000 to global list.
2020-06-23 05:59:53,625 [root] DEBUG: DLL loaded at 0x71820000: C:\Windows\system32\secur32 (0x8000 bytes).
2020-06-23 05:59:53,640 [root] DEBUG: DLL loaded at 0x717E0000: C:\Windows\system32\ncrypt (0x39000 bytes).
2020-06-23 05:59:53,640 [root] DEBUG: DLL loaded at 0x74E00000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-06-23 05:59:53,640 [root] DEBUG: DLL loaded at 0x717A0000: C:\Windows\SysWOW64\bcryptprimitives (0x3d000 bytes).
2020-06-23 05:59:53,703 [root] DEBUG: DLL loaded at 0x71780000: C:\Windows\system32\GPAPI (0x16000 bytes).
2020-06-23 05:59:53,750 [root] DEBUG: DLL loaded at 0x74A50000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-06-23 05:59:53,750 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 1516
2020-06-23 05:59:53,750 [root] DEBUG: DLL loaded at 0x748F0000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-06-23 05:59:53,765 [lib.api.process] INFO: Monitor config for process 1516: C:\tmpt2nfl3rg\dll\1516.ini
2020-06-23 05:59:53,781 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:59:53,796 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:53,796 [root] DEBUG: Loader: Injecting process 1516 (thread 4728) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:53,796 [root] DEBUG: Process image base: 0x00300000
2020-06-23 05:59:53,812 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:53,812 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 05:59:53,812 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:53,828 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1516
2020-06-23 05:59:53,828 [root] DEBUG: DLL loaded at 0x75300000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-23 05:59:53,875 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdate.exe" /update /sessionid "{FA04A27E-D95E-4D44-80EB-05C8E924CC34}".
2020-06-23 05:59:53,875 [root] DEBUG: CreateProcessHandler: Injection info set for new process 1516, ImageBase: 0x00300000
2020-06-23 05:59:53,890 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 1516
2020-06-23 05:59:53,890 [lib.api.process] INFO: Monitor config for process 1516: C:\tmpt2nfl3rg\dll\1516.ini
2020-06-23 05:59:53,890 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 05:59:53,906 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 05:59:53,921 [root] DEBUG: Loader: Injecting process 1516 (thread 4728) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:53,921 [root] DEBUG: Process image base: 0x00300000
2020-06-23 05:59:53,921 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:53,921 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-06-23 05:59:53,937 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 05:59:53,937 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1516
2020-06-23 05:59:53,968 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 05:59:53,968 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 05:59:54,140 [root] INFO: Disabling sleep skipping.
2020-06-23 05:59:54,156 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-23 05:59:54,281 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 1516 at 0x701b0000, image base 0x300000, stack from 0x1a6000-0x1b0000
2020-06-23 05:59:54,281 [root] DEBUG: DLL loaded at 0x77150000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-23 05:59:54,312 [root] DEBUG: Commandline: C:\Program Files (x86)\Google\Update\1.3.35.451\"C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdate.exe" \update \sessionid "{FA04A27E-D95E-4D44-80EB-05C8E924CC34}".
2020-06-23 05:59:54,500 [root] DEBUG: DLL loaded at 0x718A0000: C:\Windows\System32\msxml3 (0x134000 bytes).
2020-06-23 05:59:55,468 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x23400.
2020-06-23 05:59:55,687 [root] DEBUG: DLL unloaded from 0x717A0000.
2020-06-23 05:59:55,796 [root] DEBUG: DLL unloaded from 0x713B0000.
2020-06-23 05:59:55,953 [root] DEBUG: DLL unloaded from 0x757D0000.
2020-06-23 05:59:55,953 [root] DEBUG: DLL unloaded from 0x718A0000.
2020-06-23 05:59:56,046 [root] DEBUG: DLL unloaded from 0x75560000.
2020-06-23 05:59:56,546 [root] DEBUG: DLL unloaded from 0x73BA0000.
2020-06-23 05:59:56,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74B00000 for section view with handle 0xec.
2020-06-23 05:59:56,890 [root] DEBUG: DLL loaded at 0x74B00000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-06-23 05:59:56,890 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73D80000 for section view with handle 0xec.
2020-06-23 05:59:56,906 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-23 05:59:56,921 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74AD0000 for section view with handle 0xec.
2020-06-23 05:59:56,921 [root] DEBUG: DLL loaded at 0x74AD0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-06-23 05:59:56,937 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74A70000 for section view with handle 0xec.
2020-06-23 05:59:56,937 [root] DEBUG: DLL loaded at 0x74A70000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-23 05:59:56,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74A40000 for section view with handle 0xec.
2020-06-23 05:59:56,953 [root] DEBUG: DLL loaded at 0x74A40000: C:\Windows\system32\WTSAPI32 (0xd000 bytes).
2020-06-23 05:59:56,968 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x108 amd local view 0x74040000 to global list.
2020-06-23 05:59:57,000 [root] DEBUG: DLL loaded at 0x74040000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32 (0x19e000 bytes).
2020-06-23 05:59:57,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77270000 for section view with handle 0xec.
2020-06-23 05:59:57,046 [root] DEBUG: DLL loaded at 0x77270000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-23 05:59:57,062 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76DE0000 for section view with handle 0xec.
2020-06-23 05:59:57,062 [root] DEBUG: DLL loaded at 0x76DE0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-23 05:59:57,078 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x124 amd local view 0x74A30000 to global list.
2020-06-23 05:59:57,078 [root] DEBUG: DLL loaded at 0x74A30000: C:\Windows\system32\MSIMG32 (0x5000 bytes).
2020-06-23 05:59:57,078 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x743F0000 for section view with handle 0x124.
2020-06-23 05:59:57,125 [root] DEBUG: DLL loaded at 0x743F0000: C:\Windows\system32\UxTheme (0x80000 bytes).
2020-06-23 05:59:57,125 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75900000 for section view with handle 0xec.
2020-06-23 05:59:57,140 [root] DEBUG: DLL loaded at 0x75900000: C:\Windows\syswow64\WININET (0x1c4000 bytes).
2020-06-23 05:59:57,140 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76F10000 for section view with handle 0xec.
2020-06-23 05:59:57,140 [root] DEBUG: DLL loaded at 0x76F10000: C:\Windows\syswow64\api-ms-win-downlevel-user32-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:57,156 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75700000 for section view with handle 0xec.
2020-06-23 05:59:57,156 [root] DEBUG: DLL loaded at 0x75700000: C:\Windows\syswow64\api-ms-win-downlevel-shlwapi-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:57,171 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x754A0000 for section view with handle 0xec.
2020-06-23 05:59:57,171 [root] DEBUG: DLL loaded at 0x754A0000: C:\Windows\syswow64\api-ms-win-downlevel-version-l1-1-0 (0x4000 bytes).
2020-06-23 05:59:57,187 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x756F0000 for section view with handle 0xec.
2020-06-23 05:59:57,187 [root] DEBUG: DLL loaded at 0x756F0000: C:\Windows\syswow64\api-ms-win-downlevel-normaliz-l1-1-0 (0x3000 bytes).
2020-06-23 05:59:57,203 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x75AD0000 for section view with handle 0xec.
2020-06-23 05:59:57,203 [root] DEBUG: DLL loaded at 0x75AD0000: C:\Windows\syswow64\normaliz (0x3000 bytes).
2020-06-23 05:59:57,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x769F0000 for section view with handle 0xec.
2020-06-23 05:59:57,218 [root] DEBUG: DLL loaded at 0x769F0000: C:\Windows\syswow64\iertutil (0x215000 bytes).
2020-06-23 05:59:57,218 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76DF0000 for section view with handle 0xec.
2020-06-23 05:59:57,218 [root] DEBUG: DLL loaded at 0x76DF0000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-06-23 05:59:57,234 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77540000 for section view with handle 0xec.
2020-06-23 05:59:57,234 [root] DEBUG: DLL loaded at 0x77540000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes).
2020-06-23 05:59:57,265 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x14c amd local view 0x03910000 to global list.
2020-06-23 05:59:57,281 [root] DEBUG: DLL unloaded from 0x00300000.
2020-06-23 05:59:57,281 [root] DEBUG: DLL unloaded from 0x711E0000.
2020-06-23 05:59:57,312 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-23 05:59:57,312 [root] DEBUG: DLL loaded at 0x76C10000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2020-06-23 05:59:57,328 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 05:59:57,328 [root] DEBUG: DLL unloaded from 0x73BA0000.
2020-06-23 05:59:57,343 [root] DEBUG: DLL unloaded from 0x75600000.
2020-06-23 05:59:57,375 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 05:59:57,390 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x190 amd local view 0x001B0000 to global list.
2020-06-23 05:59:57,484 [root] DEBUG: DLL loaded at 0x77150000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-06-23 05:59:57,500 [root] DEBUG: DLL loaded at 0x734C0000: C:\Windows\System32\msxml3 (0x134000 bytes).
2020-06-23 05:59:57,515 [root] DEBUG: DLL loaded at 0x74E00000: C:\Windows\System32\bcrypt (0x17000 bytes).
2020-06-23 05:59:57,531 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 248, handle 0x1ec.
2020-06-23 05:59:57,562 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 328, handle 0x1ec.
2020-06-23 05:59:57,562 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 376, handle 0x1ec.
2020-06-23 05:59:57,578 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 384, handle 0x1ec.
2020-06-23 05:59:57,578 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 412, handle 0x1ec.
2020-06-23 05:59:57,609 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 472, handle 0x1ec.
2020-06-23 05:59:57,609 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 480, handle 0x1ec.
2020-06-23 05:59:57,640 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 488, handle 0x1ec.
2020-06-23 05:59:57,656 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 588, handle 0x1ec.
2020-06-23 05:59:57,656 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 668, handle 0x1ec.
2020-06-23 05:59:57,671 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 760, handle 0x1ec.
2020-06-23 05:59:57,671 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 792, handle 0x1ec.
2020-06-23 05:59:57,671 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 816, handle 0x1ec.
2020-06-23 05:59:57,671 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 840, handle 0x1ec.
2020-06-23 05:59:57,687 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 344, handle 0x1ec.
2020-06-23 05:59:57,687 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 316, handle 0x1ec.
2020-06-23 05:59:57,687 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1040, handle 0x1ec.
2020-06-23 05:59:57,703 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1104, handle 0x1ec.
2020-06-23 05:59:57,718 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1288, handle 0x1ec.
2020-06-23 05:59:57,718 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1336, handle 0x1ec.
2020-06-23 05:59:57,718 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1416, handle 0x1ec.
2020-06-23 05:59:57,734 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1424, handle 0x1ec.
2020-06-23 05:59:57,734 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1616, handle 0x1ec.
2020-06-23 05:59:57,734 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1964, handle 0x1ec.
2020-06-23 05:59:57,734 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1688, handle 0x1ec.
2020-06-23 05:59:57,750 [root] DEBUG: OpenProcessHandler: Image base for process 1688 (handle 0x1ec): 0x01020000.
2020-06-23 05:59:57,765 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2132, handle 0x1ec.
2020-06-23 05:59:57,781 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2808, handle 0x1ec.
2020-06-23 05:59:57,781 [root] DEBUG: OpenProcessHandler: Image base for process 2808 (handle 0x1ec): 0x008B0000.
2020-06-23 05:59:57,781 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 2888, handle 0x1ec.
2020-06-23 05:59:57,796 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1928, handle 0x1ec.
2020-06-23 05:59:57,796 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3904, handle 0x1ec.
2020-06-23 05:59:57,812 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1088, handle 0x1ec.
2020-06-23 05:59:57,812 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 3360, handle 0x1ec.
2020-06-23 05:59:57,812 [root] DEBUG: OpenProcessHandler: Image base for process 3360 (handle 0x1ec): 0x00400000.
2020-06-23 05:59:57,812 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 4936, handle 0x1ec.
2020-06-23 05:59:57,828 [root] DEBUG: OpenProcessHandler: Image base for process 4936 (handle 0x1ec): 0x003F0000.
2020-06-23 05:59:57,859 [root] DEBUG: OpenProcessHandler: Injection info created for Pid 1516, handle 0x218.
2020-06-23 05:59:57,921 [root] DEBUG: OpenProcessHandler: Image base for process 1516 (handle 0x1ec): 0x00300000.
2020-06-23 05:59:59,031 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe
2020-06-23 06:00:03,468 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdate.dll
2020-06-23 06:00:05,187 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe
2020-06-23 06:00:06,687 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe
2020-06-23 06:00:07,515 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe
2020-06-23 06:00:08,234 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe
2020-06-23 06:00:08,453 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_am.dll
2020-06-23 06:00:08,828 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ar.dll
2020-06-23 06:00:08,937 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bg.dll
2020-06-23 06:00:09,109 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bn.dll
2020-06-23 06:00:09,218 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ca.dll
2020-06-23 06:00:09,468 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_cs.dll
2020-06-23 06:00:09,765 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_da.dll
2020-06-23 06:00:10,328 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_de.dll
2020-06-23 06:00:10,656 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_el.dll
2020-06-23 06:00:10,984 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en.dll
2020-06-23 06:00:11,156 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en-GB.dll
2020-06-23 06:00:11,750 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es.dll
2020-06-23 06:00:12,484 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es-419.dll
2020-06-23 06:00:12,859 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_et.dll
2020-06-23 06:00:12,968 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fa.dll
2020-06-23 06:00:13,140 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fi.dll
2020-06-23 06:00:13,265 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fil.dll
2020-06-23 06:00:13,375 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fr.dll
2020-06-23 06:00:13,578 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_gu.dll
2020-06-23 06:00:13,796 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hi.dll
2020-06-23 06:00:14,281 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hr.dll
2020-06-23 06:00:14,390 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hu.dll
2020-06-23 06:00:14,562 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_id.dll
2020-06-23 06:00:14,656 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_is.dll
2020-06-23 06:00:14,828 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_it.dll
2020-06-23 06:00:14,984 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_iw.dll
2020-06-23 06:00:15,406 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ja.dll
2020-06-23 06:00:17,937 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_kn.dll
2020-06-23 06:00:18,312 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ko.dll
2020-06-23 06:00:19,046 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lt.dll
2020-06-23 06:00:19,734 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lv.dll
2020-06-23 06:00:21,031 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ml.dll
2020-06-23 06:00:21,296 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_mr.dll
2020-06-23 06:00:21,906 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ms.dll
2020-06-23 06:00:22,875 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_nl.dll
2020-06-23 06:00:23,343 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_no.dll
2020-06-23 06:00:23,953 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pl.dll
2020-06-23 06:00:24,421 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-BR.dll
2020-06-23 06:00:24,734 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-PT.dll
2020-06-23 06:00:25,375 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ro.dll
2020-06-23 06:00:25,500 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ru.dll
2020-06-23 06:00:25,640 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sk.dll
2020-06-23 06:00:26,562 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sl.dll
2020-06-23 06:00:27,515 [root] INFO: Added new file to list with pid None and path C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sr.dll
2020-06-23 06:00:34,906 [root] DEBUG: DLL unloaded from 0x00300000.
2020-06-23 06:00:36,500 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 3148
2020-06-23 06:00:36,500 [lib.api.process] INFO: Monitor config for process 3148: C:\tmpt2nfl3rg\dll\3148.ini
2020-06-23 06:00:36,593 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 06:00:36,703 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 06:00:36,718 [root] DEBUG: Loader: Injecting process 3148 (thread 1264) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 06:00:36,765 [root] DEBUG: Process image base: 0x00BF0000
2020-06-23 06:00:41,312 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 06:00:41,312 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 06:00:41,312 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 06:00:41,312 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 3148
2020-06-23 06:00:41,468 [root] DEBUG: DLL loaded at 0x75300000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-06-23 06:00:46,718 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:00:47,843 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:00:48,265 [root] INFO: Disabling sleep skipping.
2020-06-23 06:00:48,281 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-06-23 06:00:48,281 [root] DEBUG: CAPE initialised: 32-bit monitor loaded in process 3148 at 0x701b0000, image base 0xbf0000, stack from 0x3d6000-0x3e0000
2020-06-23 06:00:48,281 [root] DEBUG: Commandline: C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" \regsvc.
2020-06-23 06:00:48,343 [root] INFO: Loaded monitor into process with pid 3148
2020-06-23 06:00:48,359 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xec amd local view 0x741E0000 to global list.
2020-06-23 06:00:48,375 [root] DEBUG: DLL loaded at 0x741E0000: C:\Program Files (x86)\Google\Update\1.3.35.452\goopdate (0x1c6000 bytes).
2020-06-23 06:00:48,390 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xe8 amd local view 0x75560000 to global list.
2020-06-23 06:00:48,390 [root] DEBUG: DLL loaded at 0x75560000: C:\Windows\syswow64\OLEAUT32 (0x91000 bytes).
2020-06-23 06:00:48,390 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74EB0000 for section view with handle 0xec.
2020-06-23 06:00:48,406 [root] DEBUG: DLL loaded at 0x74EB0000: C:\Windows\system32\IPHLPAPI (0x1c000 bytes).
2020-06-23 06:00:48,421 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77140000 for section view with handle 0xe8.
2020-06-23 06:00:48,421 [root] DEBUG: DLL loaded at 0x77140000: C:\Windows\syswow64\NSI (0x6000 bytes).
2020-06-23 06:00:48,421 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74EA0000 for section view with handle 0xec.
2020-06-23 06:00:48,421 [root] DEBUG: DLL loaded at 0x74EA0000: C:\Windows\system32\WINNSI (0x7000 bytes).
2020-06-23 06:00:48,437 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74470000 for section view with handle 0xec.
2020-06-23 06:00:48,437 [root] DEBUG: DLL loaded at 0x74470000: C:\Windows\system32\msi (0x246000 bytes).
2020-06-23 06:00:48,453 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74CE0000 for section view with handle 0xec.
2020-06-23 06:00:48,453 [root] DEBUG: DLL loaded at 0x73850000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-06-23 06:00:48,453 [root] DEBUG: DLL loaded at 0x74AF0000: C:\Windows\system32\WKSCLI (0xf000 bytes).
2020-06-23 06:00:48,453 [root] DEBUG: DLL loaded at 0x74CE0000: C:\Windows\system32\NETAPI32 (0x11000 bytes).
2020-06-23 06:00:48,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74C80000 for section view with handle 0xec.
2020-06-23 06:00:48,468 [root] DEBUG: DLL loaded at 0x74C80000: C:\Windows\system32\netutils (0x9000 bytes).
2020-06-23 06:00:48,484 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74B00000 for section view with handle 0xec.
2020-06-23 06:00:48,500 [root] DEBUG: DLL loaded at 0x74B00000: C:\Windows\system32\srvcli (0x19000 bytes).
2020-06-23 06:00:48,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x73D80000 for section view with handle 0xec.
2020-06-23 06:00:48,968 [root] DEBUG: DLL loaded at 0x73D80000: C:\Windows\system32\VERSION (0x9000 bytes).
2020-06-23 06:00:48,984 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74AD0000 for section view with handle 0xec.
2020-06-23 06:00:48,984 [root] DEBUG: DLL loaded at 0x74AD0000: C:\Windows\system32\USERENV (0x17000 bytes).
2020-06-23 06:00:48,984 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74A70000 for section view with handle 0xec.
2020-06-23 06:00:49,000 [root] DEBUG: DLL loaded at 0x74A70000: C:\Windows\system32\profapi (0xb000 bytes).
2020-06-23 06:00:49,000 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x74A40000 for section view with handle 0xec.
2020-06-23 06:00:49,000 [root] DEBUG: DLL loaded at 0x74A40000: C:\Windows\system32\WTSAPI32 (0xd000 bytes).
2020-06-23 06:00:49,015 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x10c amd local view 0x74040000 to global list.
2020-06-23 06:00:49,015 [root] DEBUG: DLL loaded at 0x74040000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32 (0x19e000 bytes).
2020-06-23 06:00:49,031 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77270000 for section view with handle 0xec.
2020-06-23 06:00:50,453 [root] DEBUG: DLL loaded at 0x77270000: C:\Windows\syswow64\CRYPT32 (0x122000 bytes).
2020-06-23 06:00:54,671 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x76DE0000 for section view with handle 0xec.
2020-06-23 06:00:55,343 [root] DEBUG: DLL loaded at 0x76DE0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-06-23 06:00:55,437 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-23 06:00:55,500 [root] DEBUG: DLL loaded at 0x76C10000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2020-06-23 06:00:55,515 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 06:00:55,546 [root] DEBUG: DLL unloaded from 0x73BA0000.
2020-06-23 06:00:56,046 [root] DEBUG: DLL unloaded from 0x75600000.
2020-06-23 06:00:56,312 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 06:00:56,312 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x198 amd local view 0x00120000 to global list.
2020-06-23 06:00:56,343 [root] DEBUG: ResumeThreadHandler: CurrentInjectionInfo 0x0 (Pid 3148).
2020-06-23 06:00:56,359 [root] DEBUG: DLL unloaded from 0x741E0000.
2020-06-23 06:00:56,468 [root] DEBUG: DLL unloaded from 0x73BA0000.
2020-06-23 06:00:56,906 [root] DEBUG: DLL unloaded from 0x75600000.
2020-06-23 06:00:57,781 [root] DEBUG: DLL unloaded from 0x741E0000.
2020-06-23 06:00:59,281 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x23400.
2020-06-23 06:00:59,296 [root] DEBUG: DLL unloaded from 0x75770000.
2020-06-23 06:00:59,296 [root] DEBUG: DLL unloaded from 0x743C0000.
2020-06-23 06:00:59,296 [root] INFO: Process with pid 3148 has terminated
2020-06-23 06:00:59,328 [root] INFO: Stopping Task Scheduler Service
2020-06-23 06:00:59,421 [root] INFO: Stopped Task Scheduler Service
2020-06-23 06:00:59,531 [root] INFO: Starting Task Scheduler Service
2020-06-23 06:00:59,656 [root] INFO: Started Task Scheduler Service
2020-06-23 06:00:59,671 [lib.api.process] INFO: Monitor config for process 840: C:\tmpt2nfl3rg\dll\840.ini
2020-06-23 06:00:59,687 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\EMOwNP.dll, loader C:\tmpt2nfl3rg\bin\dIBcekkC.exe
2020-06-23 06:00:59,781 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 06:00:59,781 [root] DEBUG: Loader: Injecting process 840 (thread 0) with C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 06:00:59,828 [root] DEBUG: Error 0 (0x0) - GetProcessInitialThreadId: Remote PEB 0x000007FFFFFD7000 Local PEB 0x000007FFFFFDE000 Local TEB 0x000007FFFFFDA000: The operation completed successfully.
2020-06-23 06:00:59,921 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-06-23 06:01:00,218 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:01:00,234 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:01:00,515 [root] INFO: Disabling sleep skipping.
2020-06-23 06:01:00,562 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 840 at 0x0000000073620000, image base 0x00000000FFC60000, stack from 0x00000000023E6000-0x00000000023F0000
2020-06-23 06:01:00,562 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-06-23 06:01:00,687 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-23 06:01:00,687 [root] WARNING: b'Unable to hook LockResource'
2020-06-23 06:01:00,718 [root] INFO: Loaded monitor into process with pid 840
2020-06-23 06:01:00,750 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 06:01:00,796 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 06:01:01,015 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 06:01:10,468 [root] DEBUG: DLL loaded at 0x74330000: C:\Windows\SysWOW64\taskschd (0x7d000 bytes).
2020-06-23 06:01:10,546 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x1f0 amd local view 0x00440000 to global list.
2020-06-23 06:01:10,562 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x21c amd local view 0x00440000 to global list.
2020-06-23 06:01:12,234 [root] INFO: Announced 32-bit process name: GoogleUpdate.exe pid: 2732
2020-06-23 06:01:12,249 [lib.api.process] INFO: Monitor config for process 2732: C:\tmpt2nfl3rg\dll\2732.ini
2020-06-23 06:01:12,328 [lib.api.process] INFO: 32-bit DLL to inject is C:\tmpt2nfl3rg\dll\iEAHQw.dll, loader C:\tmpt2nfl3rg\bin\pipMOfD.exe
2020-06-23 06:01:12,453 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 06:01:12,515 [root] DEBUG: Loader: Injecting process 2732 (thread 3196) with C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 06:01:12,640 [root] DEBUG: Process image base: 0x00BF0000
2020-06-23 06:01:18,640 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 06:01:18,640 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-06-23 06:01:18,640 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\iEAHQw.dll.
2020-06-23 06:01:18,703 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2732
2020-06-23 06:01:18,843 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver.
2020-06-23 06:01:23,765 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF57B0000 to caller regions list (ntdll::NtWaitForSingleObject).
2020-06-23 06:01:24,656 [root] INFO: Loaded monitor into process with pid 2732
2020-06-23 06:01:24,718 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xec amd local view 0x71810000 to global list.
2020-06-23 06:01:29,031 [root] DEBUG: DLL unloaded from 0x000007FEFF630000.
2020-06-23 06:01:30,640 [root] DEBUG: DLL loaded at 0x73850000: C:\Windows\system32\SAMCLI (0xf000 bytes).
2020-06-23 06:01:36,906 [root] DEBUG: DLL loaded at 0x76DF0000: C:\Windows\syswow64\api-ms-win-downlevel-advapi32-l1-1-0 (0x5000 bytes).
2020-06-23 06:01:36,953 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x77540000 for section view with handle 0xec.
2020-06-23 06:01:36,953 [root] DEBUG: DLL loaded at 0x77540000: C:\Windows\syswow64\WINTRUST (0x2f000 bytes).
2020-06-23 06:01:37,031 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x150 amd local view 0x03890000 to global list.
2020-06-23 06:01:37,750 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-06-23 06:01:37,765 [root] DEBUG: DLL loaded at 0x76C10000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2020-06-23 06:01:42,687 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 06:01:42,734 [root] DEBUG: DLL loaded at 0x73BA0000: C:\Windows\system32\dbghelp (0xeb000 bytes).
2020-06-23 06:01:42,812 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF09E0000 to caller regions list (msvcrt::memcpy).
2020-06-23 06:01:48,640 [root] DEBUG: CreateProcessHandler: using lpCommandLine: "C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe"  .
2020-06-23 06:01:48,640 [root] DEBUG: CreateProcessHandler: Injection info set for new process 3816, ImageBase: 0x3FEB0000
2020-06-23 06:01:48,796 [root] INFO: Announced 64-bit process name: GoogleUpdateComRegisterShell64.exe pid: 3816
2020-06-23 06:01:48,796 [lib.api.process] INFO: Monitor config for process 3816: C:\tmpt2nfl3rg\dll\3816.ini
2020-06-23 06:01:48,843 [lib.api.process] INFO: 64-bit DLL to inject is C:\tmpt2nfl3rg\dll\EMOwNP.dll, loader C:\tmpt2nfl3rg\bin\dIBcekkC.exe
2020-06-23 06:01:48,859 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\etdyAjbpsf.
2020-06-23 06:01:48,859 [root] DEBUG: Loader: Injecting process 3816 (thread 4808) with C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 06:01:48,921 [root] DEBUG: Process image base: 0x000000013FEB0000
2020-06-23 06:01:48,968 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 06:01:48,968 [root] DEBUG: InjectDllViaIAT: Failed to allocate region in target process for new import table.
2020-06-23 06:01:48,968 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-06-23 06:01:49,218 [root] DEBUG: Python path set to 'C:\Users\Louise\AppData\Local\Programs\Python\Python38-32'.
2020-06-23 06:01:49,249 [root] DEBUG: Dropped file limit defaulting to 100.
2020-06-23 06:01:49,296 [root] INFO: Disabling sleep skipping.
2020-06-23 06:01:49,343 [root] DEBUG: CAPE initialised: 64-bit monitor loaded in process 3816 at 0x0000000073620000, image base 0x000000013FEB0000, stack from 0x00000000002C6000-0x00000000002D0000
2020-06-23 06:01:49,343 [root] DEBUG: Commandline: C:\Program Files (x86)\Google\Update\1.3.35.452\"C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe".
2020-06-23 06:01:49,453 [root] WARNING: b'Unable to place hook on LockResource'
2020-06-23 06:01:49,453 [root] WARNING: b'Unable to hook LockResource'
2020-06-23 06:01:49,531 [root] INFO: Loaded monitor into process with pid 3816
2020-06-23 06:01:49,781 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-06-23 06:01:49,859 [root] INFO: Analysis timeout hit, terminating analysis.
2020-06-23 06:01:49,859 [lib.api.process] ERROR: Failed to open terminate event for pid 1156
2020-06-23 06:01:49,859 [root] INFO: Terminate event set for process 1156.
2020-06-23 06:01:49,859 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-06-23 06:01:49,859 [lib.api.process] INFO: Terminate event set for process 3360
2020-06-23 06:01:49,875 [root] DEBUG: Successfully injected DLL C:\tmpt2nfl3rg\dll\EMOwNP.dll.
2020-06-23 06:01:49,890 [root] DEBUG: Terminate Event: Attempting to dump process 3360
2020-06-23 06:01:49,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xd8 amd local view 0x00000000036E0000 to global list.
2020-06-23 06:01:49,937 [lib.api.process] INFO: Termination confirmed for process 3360
2020-06-23 06:01:49,937 [root] INFO: Terminate event set for process 3360.
2020-06-23 06:01:49,953 [lib.api.process] INFO: Terminate event set for process 472
2020-06-23 06:01:50,296 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x50000.
2020-06-23 06:01:50,296 [lib.api.process] INFO: Termination confirmed for process 472
2020-06-23 06:01:50,296 [root] INFO: Terminate event set for process 472.
2020-06-23 06:01:50,296 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 472
2020-06-23 06:01:50,296 [lib.api.process] ERROR: Failed to open terminate event for pid 3248
2020-06-23 06:01:50,312 [root] INFO: Terminate event set for process 3248.
2020-06-23 06:01:50,406 [lib.api.process] INFO: Terminate event set for process 588
2020-06-23 06:01:50,406 [root] DEBUG: Terminate Event: Attempting to dump process 588
2020-06-23 06:01:50,500 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FFC60000.
2020-06-23 06:01:50,609 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 06:01:50,687 [lib.api.process] INFO: Termination confirmed for process 588
2020-06-23 06:01:50,687 [root] INFO: Terminate event set for process 588.
2020-06-23 06:01:50,687 [lib.api.process] ERROR: Failed to open terminate event for pid 2596
2020-06-23 06:01:50,687 [root] INFO: Terminate event set for process 2596.
2020-06-23 06:01:50,843 [lib.api.process] ERROR: Failed to open terminate event for pid 4552
2020-06-23 06:01:50,843 [root] INFO: Terminate event set for process 4552.
2020-06-23 06:01:51,015 [lib.api.process] INFO: Terminate event set for process 840
2020-06-23 06:01:51,015 [root] DEBUG: Terminate Event: Attempting to dump process 840
2020-06-23 06:01:51,046 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00000000FFC60000.
2020-06-23 06:01:51,156 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 06:01:51,218 [lib.api.process] INFO: Termination confirmed for process 840
2020-06-23 06:01:51,312 [root] INFO: Terminate event set for process 840.
2020-06-23 06:01:51,312 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF6170000 to caller regions list (advapi32::RegOpenKeyExW).
2020-06-23 06:01:51,453 [root] DEBUG: Terminate Event: Attempting to dump process 2732
2020-06-23 06:01:51,453 [lib.api.process] INFO: Terminate event set for process 2732
2020-06-23 06:01:51,453 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x00BF0000.
2020-06-23 06:01:51,453 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 06:01:51,593 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00BF0000.
2020-06-23 06:01:52,640 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x23400.
2020-06-23 06:01:54,796 [root] DEBUG: DLL loaded at 0x000007FEFD460000: C:\Windows\system32\cryptbase (0xf000 bytes).
2020-06-23 06:01:56,531 [lib.api.process] INFO: Termination confirmed for process 2732
2020-06-23 06:01:56,531 [root] INFO: Terminate event set for process 2732.
2020-06-23 06:01:56,578 [lib.api.process] INFO: Terminate event set for process 3816
2020-06-23 06:01:56,828 [root] DEBUG: Terminate Event: Attempting to dump process 3816
2020-06-23 06:01:56,968 [root] DEBUG: DoProcessDump: Dumping Imagebase at 0x000000013FEB0000.
2020-06-23 06:01:56,968 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-06-23 06:01:57,078 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x000000013FEB0000.
2020-06-23 06:01:57,078 [root] DEBUG: DumpProcess: Module entry point VA is 0x000000000000532C.
2020-06-23 06:01:58,031 [root] DEBUG: set_caller_info: Adding region at 0x000007FEF75D0000 to caller regions list (kernel32::GetSystemTimeAsFileTime).
2020-06-23 06:01:58,031 [root] DEBUG: set_caller_info: Calling region at 0x000007FEF75D0000 skipped.
2020-06-23 06:01:58,640 [root] DEBUG: Terminate Event: Shutdown complete for process 2732 but failed to inform analyzer.
2020-06-23 06:01:58,890 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x2b000.
2020-06-23 06:01:58,937 [root] DEBUG: Terminate Event: CAPE shutdown complete for process 3816
2020-06-23 06:01:58,937 [lib.api.process] INFO: Termination confirmed for process 3816
2020-06-23 06:01:58,953 [root] INFO: Terminate event set for process 3816.
2020-06-23 06:01:58,953 [root] INFO: Created shutdown mutex.
2020-06-23 06:01:59,890 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0xbc amd local view 0x742E0000 to global list.
2020-06-23 06:01:59,921 [root] DEBUG: DLL loaded at 0x742E0000: C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine (0x42000 bytes).
2020-06-23 06:02:00,015 [root] INFO: Shutting down package.
2020-06-23 06:02:00,015 [root] INFO: Stopping auxiliary modules.
2020-06-23 06:02:00,109 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x930 amd local view 0x0000000000C00000 to global list.
2020-06-23 06:02:00,156 [root] INFO: Added new file to list with pid None and path C:\Windows\appcompat\Programs\RecentFileCache.bcf
2020-06-23 06:02:00,171 [root] DEBUG: MapSectionViewHandler: Added section view with handle 0x990 amd local view 0x0000000000C50000 to global list.
2020-06-23 06:02:00,312 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000049E40000 for section view with handle 0x930.
2020-06-23 06:02:00,375 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x0000000000C20000 for section view with handle 0x930.
2020-06-23 06:02:00,468 [root] DEBUG: MapSectionViewHandler: Updated local view to 0x000000004AC80000 for section view with handle 0x930.
2020-06-23 06:02:00,484 [lib.common.results] WARNING: File C:\JAAycO\bin\procmon.xml doesn't exist anymore
2020-06-23 06:02:00,484 [root] INFO: Finishing auxiliary modules.
2020-06-23 06:02:00,484 [root] INFO: Shutting down pipe server and dumping dropped files.
2020-06-23 06:02:00,515 [root] WARNING: File at path 'c:\\users\\louise\\appdata\\local\\temp\\{451d95a8-db86-40a5-9a81-678c947dccc9}-googleupdatesetup.exe' does not exist, skip.
2020-06-23 06:02:00,687 [root] DEBUG: DLL unloaded from 0x000007FEF37A0000.
2020-06-23 06:02:00,703 [root] DEBUG: DLL unloaded from 0x000007FEFA790000.
2020-06-23 06:02:00,796 [root] DEBUG: DLL unloaded from 0x00000000775B0000.
2020-06-23 06:02:00,796 [root] DEBUG: DLL unloaded from 0x000007FEFA790000.
2020-06-23 06:02:01,140 [root] DEBUG: DLL unloaded from 0x00000000775B0000.
2020-06-23 06:02:04,468 [root] WARNING: Folder at path "C:\JAAycO\debugger" does not exist, skip.
2020-06-23 06:02:04,484 [root] WARNING: Monitor injection attempted but failed for process 4936.
2020-06-23 06:02:04,484 [root] WARNING: Monitor injection attempted but failed for process 1516.
2020-06-23 06:02:04,531 [root] INFO: Analysis completed.

Machine

Name Label Manager Started On Shutdown On
win7x64_2 win7x64_6 KVM 2020-06-23 05:59:29 2020-06-23 06:05:17

File Details

File Name q2w0yYbvMGBN
File Size 650752 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
PE timestamp 1992-06-19 22:22:17
MD5 f61c6a4a29390cc4e46afb3d8d54f8bb
SHA1 ecfb821d87ddc2b41d06e40e8d0edd135b11f4fd
SHA256 9ed49839f97c5bd2844562286ae50e5ccf1dcf6d0b47399d857f4fd8671c01db
SHA512 f723c98baeb866530846be2e82e9449621ae7470721f8a38a3856548e96d2e2d900dd137fb6062b4b7b8b6a78e52eb8ca01e4c01aa330eff4a86367a71aa0256
CRC32 2F501466
Ssdeep 12288:sDRuXrEbb00e9ElcwOixtthKGc7WR5Sc7YpDqI49XG3njFtsLFvEd:OYbQhe9RKthmg5AN492XjFKvK
Download Download ZIP Resubmit sample

Signatures

Behavioural detection: Executable code extraction - unpacking
SetUnhandledExceptionFilter detected (possible anti-debug)
Attempts to connect to a dead IP:Port (4 unique times)
IP: 194.180.224.87:80 (unknown)
IP: 172.217.2.99:443 (United States)
IP: 185.46.139.12:80
IP: 172.217.164.174:80
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 1156 trigged the Yara rule 'HeavensGate'
Hit: PID 1156 trigged the Yara rule 'Loki'
Hit: PID 1156 trigged the Yara rule 'shellcode_patterns'
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
process: q2w0yYbvMGBN.exe, PID 1156
A process attempted to delay the analysis task.
Process: q2w0yYbvMGBN.exe tried to sleep 360.48 seconds, actually delayed analysis time by 0.0 seconds
Dynamic (imported) function loading detected
DynamicLoader: IMM32.DLL/ImmCreateContext
DynamicLoader: IMM32.DLL/ImmDestroyContext
DynamicLoader: IMM32.DLL/ImmNotifyIME
DynamicLoader: IMM32.DLL/ImmAssociateContext
DynamicLoader: IMM32.DLL/ImmReleaseContext
DynamicLoader: IMM32.DLL/ImmGetContext
DynamicLoader: IMM32.DLL/ImmGetCompositionStringA
DynamicLoader: IMM32.DLL/ImmSetCompositionStringA
DynamicLoader: IMM32.DLL/ImmGetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCompositionStringW
DynamicLoader: IMM32.DLL/ImmSetCandidateWindow
DynamicLoader: kernel32.dll/GetDiskFreeSpaceExA
DynamicLoader: oleaut32.dll/VariantChangeTypeEx
DynamicLoader: oleaut32.dll/VarNeg
DynamicLoader: oleaut32.dll/VarNot
DynamicLoader: oleaut32.dll/VarAdd
DynamicLoader: oleaut32.dll/VarSub
DynamicLoader: oleaut32.dll/VarMul
DynamicLoader: oleaut32.dll/VarDiv
DynamicLoader: oleaut32.dll/VarIdiv
DynamicLoader: oleaut32.dll/VarMod
DynamicLoader: oleaut32.dll/VarAnd
DynamicLoader: oleaut32.dll/VarOr
DynamicLoader: oleaut32.dll/VarXor
DynamicLoader: oleaut32.dll/VarCmp
DynamicLoader: oleaut32.dll/VarI4FromStr
DynamicLoader: oleaut32.dll/VarR4FromStr
DynamicLoader: oleaut32.dll/VarR8FromStr
DynamicLoader: oleaut32.dll/VarDateFromStr
DynamicLoader: oleaut32.dll/VarCyFromStr
DynamicLoader: oleaut32.dll/VarBoolFromStr
DynamicLoader: oleaut32.dll/VarBstrFromCy
DynamicLoader: oleaut32.dll/VarBstrFromDate
DynamicLoader: oleaut32.dll/VarBstrFromBool
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/AnimateWindow
DynamicLoader: comctl32.dll/InitializeFlatSB
DynamicLoader: comctl32.dll/UninitializeFlatSB
DynamicLoader: comctl32.dll/FlatSB_GetScrollProp
DynamicLoader: comctl32.dll/FlatSB_SetScrollProp
DynamicLoader: comctl32.dll/FlatSB_EnableScrollBar
DynamicLoader: comctl32.dll/FlatSB_ShowScrollBar
DynamicLoader: comctl32.dll/FlatSB_GetScrollRange
DynamicLoader: comctl32.dll/FlatSB_GetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_GetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollPos
DynamicLoader: comctl32.dll/FlatSB_SetScrollInfo
DynamicLoader: comctl32.dll/FlatSB_SetScrollRange
DynamicLoader: USER32.dll/SetLayeredWindowAttributes
DynamicLoader: kernel32.dll/FileTimeToSystemTime
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: nss3.dll/NSS_Init
DynamicLoader: nss3.dll/NSS_Shutdown
DynamicLoader: nss3.dll/PK11_GetInternalKeySlot
DynamicLoader: nss3.dll/PK11_FreeSlot
DynamicLoader: nss3.dll/PK11_Authenticate
DynamicLoader: nss3.dll/PK11SDR_Decrypt
DynamicLoader: nss3.dll/PK11_CheckUserPassword
DynamicLoader: nss3.dll/SECITEM_FreeItem
DynamicLoader: kernel32.dll/SetThreadDescription
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: softokn3.dll/NSC_GetFunctionList
DynamicLoader: softokn3.dll/NSC_ModuleDBFunc
DynamicLoader: softokn3.dll/NSC_GetFunctionList
DynamicLoader: freebl3.dll/FREEBL_GetVector
DynamicLoader: CRYPTBASE.dll/SystemFunction001
DynamicLoader: CRYPTBASE.dll/SystemFunction002
DynamicLoader: CRYPTBASE.dll/SystemFunction003
DynamicLoader: CRYPTBASE.dll/SystemFunction004
DynamicLoader: CRYPTBASE.dll/SystemFunction005
DynamicLoader: CRYPTBASE.dll/SystemFunction028
DynamicLoader: CRYPTBASE.dll/SystemFunction029
DynamicLoader: CRYPTBASE.dll/SystemFunction034
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: CRYPTBASE.dll/SystemFunction040
DynamicLoader: CRYPTBASE.dll/SystemFunction041
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: vaultcli.dll/VaultEnumerateItems
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: vaultcli.dll/VaultFree
DynamicLoader: vaultcli.dll/VaultGetItem
DynamicLoader: vaultcli.dll/VaultOpenVault
DynamicLoader: vaultcli.dll/VaultCloseVault
DynamicLoader: nss3.dll/NSS_Init
DynamicLoader: nss3.dll/NSS_Shutdown
DynamicLoader: nss3.dll/PK11_GetInternalKeySlot
DynamicLoader: nss3.dll/PK11_FreeSlot
DynamicLoader: nss3.dll/PK11_Authenticate
DynamicLoader: nss3.dll/PK11SDR_Decrypt
DynamicLoader: nss3.dll/PK11_CheckUserPassword
DynamicLoader: nss3.dll/SECITEM_FreeItem
DynamicLoader: nss3.dll/sqlite3_finalize
DynamicLoader: nss3.dll/sqlite3_step
DynamicLoader: nss3.dll/sqlite3_close
DynamicLoader: nss3.dll/sqlite3_column_text
DynamicLoader: nss3.dll/sqlite3_open16
DynamicLoader: nss3.dll/sqlite3_prepare_v2
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptSetKeyParam
DynamicLoader: CRYPTSP.dll/CryptDecrypt
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
DynamicLoader: NETAPI32.DLL/NetUserGetInfo
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: goopdate.dll/DllEntry
DynamicLoader: kernel32.dll/RtlCaptureStackBackTrace
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: kernel32.dll/CreateMutexExW
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: psmachine.dll/DllGetClassObject
DynamicLoader: psmachine.dll/DllCanUnloadNow
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/GetNativeSystemInfo
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: winhttp.DLL/WinHttpAddRequestHeaders
DynamicLoader: winhttp.DLL/WinHttpCheckPlatform
DynamicLoader: winhttp.DLL/WinHttpCloseHandle
DynamicLoader: winhttp.DLL/WinHttpConnect
DynamicLoader: winhttp.DLL/WinHttpCrackUrl
DynamicLoader: winhttp.DLL/WinHttpCreateUrl
DynamicLoader: winhttp.DLL/WinHttpDetectAutoProxyConfigUrl
DynamicLoader: winhttp.DLL/WinHttpGetIEProxyConfigForCurrentUser
DynamicLoader: winhttp.DLL/WinHttpGetDefaultProxyConfiguration
DynamicLoader: winhttp.DLL/WinHttpGetProxyForUrl
DynamicLoader: winhttp.DLL/WinHttpOpen
DynamicLoader: winhttp.DLL/WinHttpOpenRequest
DynamicLoader: winhttp.DLL/WinHttpQueryAuthSchemes
DynamicLoader: winhttp.DLL/WinHttpQueryDataAvailable
DynamicLoader: winhttp.DLL/WinHttpQueryHeaders
DynamicLoader: winhttp.DLL/WinHttpQueryOption
DynamicLoader: winhttp.DLL/WinHttpReadData
DynamicLoader: winhttp.DLL/WinHttpReceiveResponse
DynamicLoader: winhttp.DLL/WinHttpSendRequest
DynamicLoader: winhttp.DLL/WinHttpSetDefaultProxyConfiguration
DynamicLoader: winhttp.DLL/WinHttpSetCredentials
DynamicLoader: winhttp.DLL/WinHttpSetOption
DynamicLoader: winhttp.DLL/WinHttpSetStatusCallback
DynamicLoader: winhttp.DLL/WinHttpSetTimeouts
DynamicLoader: winhttp.DLL/WinHttpWriteData
DynamicLoader: ADVAPI32.dll/SetThreadToken
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: NSI.dll/NsiAllocateAndGetTable
DynamicLoader: CFGMGR32.dll/CM_Open_Class_Key_ExW
DynamicLoader: IPHLPAPI.DLL/ConvertInterfaceGuidToLuid
DynamicLoader: IPHLPAPI.DLL/GetIfEntry2
DynamicLoader: IPHLPAPI.DLL/GetIpForwardTable2
DynamicLoader: IPHLPAPI.DLL/GetIpNetEntry2
DynamicLoader: IPHLPAPI.DLL/FreeMibTable
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: NSI.dll/NsiFreeTable
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RevertToSelf
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: SHLWAPI.dll/StrCmpNW
DynamicLoader: SHLWAPI.dll/
DynamicLoader: WS2_32.dll/GetAddrInfoW
DynamicLoader: WS2_32.dll/WSASocketW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSAIoctl
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: schannel.dll/SpUserModeInitialize
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: WS2_32.dll/FreeAddrInfoW
DynamicLoader: WS2_32.dll/WSASend
DynamicLoader: WS2_32.dll/WSARecv
DynamicLoader: ADVAPI32.dll/RevertToSelf
DynamicLoader: secur32.dll/FreeContextBuffer
DynamicLoader: ncrypt.dll/SslOpenProvider
DynamicLoader: ncrypt.dll/GetSChannelInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: ncrypt.dll/SslIncrementProviderReferenceCount
DynamicLoader: ncrypt.dll/SslImportKey
DynamicLoader: bcryptprimitives.dll/GetCipherInterface
DynamicLoader: ncrypt.dll/SslLookupCipherSuiteInfo
DynamicLoader: ncrypt.dll/SslLookupCipherLengths
DynamicLoader: USER32.dll/LoadStringW
DynamicLoader: ncrypt.dll/BCryptOpenAlgorithmProvider
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: ncrypt.dll/BCryptGetProperty
DynamicLoader: ncrypt.dll/BCryptCreateHash
DynamicLoader: ncrypt.dll/BCryptHashData
DynamicLoader: ncrypt.dll/BCryptFinishHash
DynamicLoader: ncrypt.dll/BCryptDestroyHash
DynamicLoader: CRYPT32.dll/CertGetCertificateChain
DynamicLoader: USERENV.dll/GetUserProfileDirectoryW
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: sechost.dll/ConvertStringSidToSidW
DynamicLoader: USERENV.dll/RegisterGPNotification
DynamicLoader: GPAPI.dll/RegisterGPNotificationInternal
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/CloseServiceHandle
DynamicLoader: sechost.dll/QueryServiceConfigW
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: WINSTA.dll/WinStationRegisterNotificationEvent
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: ADVAPI32.dll/CreateWellKnownSid
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/RpcAsyncInitializeHandle
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/NdrAsyncClientCall
DynamicLoader: bcryptprimitives.dll/GetSignatureInterface
DynamicLoader: ncrypt.dll/BCryptImportKeyPair
DynamicLoader: ncrypt.dll/BCryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptGetKeyParam
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptVerifySignatureA
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: bcryptprimitives.dll/GetAsymmetricEncryptionInterface
DynamicLoader: ncrypt.dll/BCryptVerifySignature
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: CRYPT32.dll/CertVerifyCertificateChainPolicy
DynamicLoader: CRYPT32.dll/CertFreeCertificateChain
DynamicLoader: CRYPT32.dll/CertDuplicateCertificateContext
DynamicLoader: ncrypt.dll/SslEncryptPacket
DynamicLoader: ncrypt.dll/SslDecryptPacket
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: WINSTA.dll/WinStationEnumerateW
DynamicLoader: RPCRT4.dll/I_RpcExceptionFilter
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: WINSTA.dll/WinStationFreeMemory
DynamicLoader: WINSTA.dll/WinStationQueryInformationW
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: kernel32.dll/WTSGetActiveConsoleSessionId
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: ntdll.dll/RtlGetVersion
DynamicLoader: CRYPT32.dll/CertFreeCertificateContext
DynamicLoader: COMCTL32.dll/RegisterClassNameW
DynamicLoader: UxTheme.dll/EnableThemeDialogTexture
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: COMCTL32.dll/
DynamicLoader: kernel32.dll/GetProcessId
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: CRYPT32.dll/CertFreeCertificateContext
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ncrypt.dll/SslFreeObject
DynamicLoader: COMCTL32.dll/
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ole32.dll/CoInitializeSecurity
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ole32.dll/CoInitializeSecurity
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ole32.dll/CoInitializeSecurity
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: goopdate.dll/DllEntry
DynamicLoader: kernel32.dll/RtlCaptureStackBackTrace
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: kernel32.dll/CreateMutexExW
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: kernel32.dll/WTSGetActiveConsoleSessionId
DynamicLoader: WINSTA.dll/WinStationQueryInformationW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ADVAPI32.dll/CreateWellKnownSid
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: RPCRT4.dll/NdrClientCall2
DynamicLoader: RPCRT4.dll/I_RpcExceptionFilter
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: winhttp.DLL/WinHttpAddRequestHeaders
DynamicLoader: winhttp.DLL/WinHttpCheckPlatform
DynamicLoader: winhttp.DLL/WinHttpCloseHandle
DynamicLoader: winhttp.DLL/WinHttpConnect
DynamicLoader: winhttp.DLL/WinHttpCrackUrl
DynamicLoader: winhttp.DLL/WinHttpCreateUrl
DynamicLoader: winhttp.DLL/WinHttpDetectAutoProxyConfigUrl
DynamicLoader: winhttp.DLL/WinHttpGetIEProxyConfigForCurrentUser
DynamicLoader: winhttp.DLL/WinHttpGetDefaultProxyConfiguration
DynamicLoader: winhttp.DLL/WinHttpGetProxyForUrl
DynamicLoader: winhttp.DLL/WinHttpOpen
DynamicLoader: winhttp.DLL/WinHttpOpenRequest
DynamicLoader: winhttp.DLL/WinHttpQueryAuthSchemes
DynamicLoader: winhttp.DLL/WinHttpQueryDataAvailable
DynamicLoader: winhttp.DLL/WinHttpQueryHeaders
DynamicLoader: winhttp.DLL/WinHttpQueryOption
DynamicLoader: winhttp.DLL/WinHttpReadData
DynamicLoader: winhttp.DLL/WinHttpReceiveResponse
DynamicLoader: winhttp.DLL/WinHttpSendRequest
DynamicLoader: winhttp.DLL/WinHttpSetDefaultProxyConfiguration
DynamicLoader: winhttp.DLL/WinHttpSetCredentials
DynamicLoader: winhttp.DLL/WinHttpSetOption
DynamicLoader: winhttp.DLL/WinHttpSetStatusCallback
DynamicLoader: winhttp.DLL/WinHttpSetTimeouts
DynamicLoader: winhttp.DLL/WinHttpWriteData
DynamicLoader: ADVAPI32.dll/SetThreadToken
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: NSI.dll/NsiAllocateAndGetTable
DynamicLoader: CFGMGR32.dll/CM_Open_Class_Key_ExW
DynamicLoader: IPHLPAPI.DLL/ConvertInterfaceGuidToLuid
DynamicLoader: IPHLPAPI.DLL/GetIfEntry2
DynamicLoader: IPHLPAPI.DLL/GetIpForwardTable2
DynamicLoader: IPHLPAPI.DLL/GetIpNetEntry2
DynamicLoader: IPHLPAPI.DLL/FreeMibTable
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: NSI.dll/NsiFreeTable
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RevertToSelf
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: ADVAPI32.dll/RegDeleteTreeA
DynamicLoader: ADVAPI32.dll/RegDeleteTreeW
DynamicLoader: SHLWAPI.dll/StrCmpNW
DynamicLoader: SHLWAPI.dll/
DynamicLoader: WS2_32.dll/GetAddrInfoW
DynamicLoader: WS2_32.dll/WSASocketW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/WSAIoctl
DynamicLoader: WS2_32.dll/FreeAddrInfoW
DynamicLoader: WS2_32.dll/
DynamicLoader: WS2_32.dll/
DynamicLoader: schannel.dll/SpUserModeInitialize
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: WS2_32.dll/WSASend
DynamicLoader: WS2_32.dll/WSARecv
DynamicLoader: ADVAPI32.dll/RevertToSelf
DynamicLoader: secur32.dll/FreeContextBuffer
DynamicLoader: ncrypt.dll/SslOpenProvider
DynamicLoader: ncrypt.dll/GetSChannelInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: ncrypt.dll/SslIncrementProviderReferenceCount
DynamicLoader: ncrypt.dll/SslImportKey
DynamicLoader: bcryptprimitives.dll/GetCipherInterface
DynamicLoader: ncrypt.dll/SslLookupCipherSuiteInfo
DynamicLoader: ncrypt.dll/SslLookupCipherLengths
DynamicLoader: USER32.dll/LoadStringW
DynamicLoader: ncrypt.dll/BCryptOpenAlgorithmProvider
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: ncrypt.dll/BCryptGetProperty
DynamicLoader: ncrypt.dll/BCryptCreateHash
DynamicLoader: ncrypt.dll/BCryptHashData
DynamicLoader: ncrypt.dll/BCryptFinishHash
DynamicLoader: ncrypt.dll/BCryptDestroyHash
DynamicLoader: CRYPT32.dll/CertGetCertificateChain
DynamicLoader: USERENV.dll/GetUserProfileDirectoryW
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: sechost.dll/ConvertStringSidToSidW
DynamicLoader: USERENV.dll/RegisterGPNotification
DynamicLoader: GPAPI.dll/RegisterGPNotificationInternal
DynamicLoader: sechost.dll/OpenSCManagerW
DynamicLoader: sechost.dll/OpenServiceW
DynamicLoader: sechost.dll/CloseServiceHandle
DynamicLoader: sechost.dll/QueryServiceConfigW
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: WINSTA.dll/WinStationRegisterNotificationEvent
DynamicLoader: RPCRT4.dll/RpcAsyncInitializeHandle
DynamicLoader: RPCRT4.dll/NdrAsyncClientCall
DynamicLoader: bcryptprimitives.dll/GetSignatureInterface
DynamicLoader: ncrypt.dll/BCryptImportKeyPair
DynamicLoader: ncrypt.dll/BCryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptGetKeyParam
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptVerifySignatureA
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: bcryptprimitives.dll/GetAsymmetricEncryptionInterface
DynamicLoader: ncrypt.dll/BCryptVerifySignature
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: bcryptprimitives.dll/GetHashInterface
DynamicLoader: CRYPT32.dll/CertVerifyCertificateChainPolicy
DynamicLoader: CRYPT32.dll/CertFreeCertificateChain
DynamicLoader: CRYPT32.dll/CertDuplicateCertificateContext
DynamicLoader: ncrypt.dll/SslEncryptPacket
DynamicLoader: ncrypt.dll/SslDecryptPacket
DynamicLoader: CRYPT32.dll/CertFreeCertificateContext
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: CRYPT32.dll/CertFreeCertificateContext
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: ncrypt.dll/SslFreeObject
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: goopdate.dll/DllEntry
DynamicLoader: kernel32.dll/RtlCaptureStackBackTrace
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: kernel32.dll/CreateMutexExW
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: ntdll.dll/NtQueryInformationProcess
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: PSAPI.DLL/GetProcessImageFileNameW
DynamicLoader: SspiCli.dll/GetUserNameExW
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: goopdate.dll/DllEntry
DynamicLoader: kernel32.dll/RtlCaptureStackBackTrace
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: kernel32.dll/CreateMutexExW
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: ADVAPI32.dll/RegDeleteKeyExW
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: api-ms-win-downlevel-advapi32-l1-1-0.dll/UnregisterTraceGuids
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: goopdate.dll/DllEntry
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/RtlCaptureStackBackTrace
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: kernel32.dll/CreateMutexExW
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: dbghelp.dll/MiniDumpWriteDump
DynamicLoader: RPCRT4.dll/UuidCreate
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: psmachine.dll/DllRegisterServer
DynamicLoader: ADVAPI32.dll/RegDeleteKeyExW
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/SetDefaultDllDirectories
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: api-ms-win-core-synch-l1-2-0.DLL/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/InitializeCriticalSectionEx
DynamicLoader: kernel32.dll/InitOnceExecuteOnce
DynamicLoader: kernel32.dll/CreateEventExW
DynamicLoader: kernel32.dll/CreateSemaphoreW
DynamicLoader: kernel32.dll/CreateSemaphoreExW
DynamicLoader: kernel32.dll/CreateThreadpoolTimer
DynamicLoader: kernel32.dll/SetThreadpoolTimer
DynamicLoader: kernel32.dll/WaitForThreadpoolTimerCallbacks
DynamicLoader: kernel32.dll/CloseThreadpoolTimer
DynamicLoader: kernel32.dll/CreateThreadpoolWait
DynamicLoader: kernel32.dll/SetThreadpoolWait
DynamicLoader: kernel32.dll/CloseThreadpoolWait
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/FreeLibraryWhenCallbackReturns
DynamicLoader: kernel32.dll/GetCurrentProcessorNumber
DynamicLoader: kernel32.dll/CreateSymbolicLinkW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/GetTickCount64
DynamicLoader: kernel32.dll/GetFileInformationByHandleEx
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: kernel32.dll/GetSystemTimePreciseAsFileTime
DynamicLoader: kernel32.dll/InitializeConditionVariable
DynamicLoader: kernel32.dll/WakeConditionVariable
DynamicLoader: kernel32.dll/WakeAllConditionVariable
DynamicLoader: kernel32.dll/SleepConditionVariableCS
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/TryAcquireSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/SleepConditionVariableSRW
DynamicLoader: kernel32.dll/CreateThreadpoolWork
DynamicLoader: kernel32.dll/SubmitThreadpoolWork
DynamicLoader: kernel32.dll/CloseThreadpoolWork
DynamicLoader: kernel32.dll/CompareStringEx
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCMapStringEx
DynamicLoader: psmachine_64.dll/DllRegisterServer
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: ADVAPI32.dll/RegDeleteKeyExW
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: kernel32.dll/FlsFree
At least one IP Address, Domain, or File Name was found in a crypto call
ioc: http://crl.globalsign.net/root-r2.crl0
Encrypts a single HTTP packet
http_request: POST /service/update2?cup2key=10:67609600&cup2hreq=25dd334ecce228d128ace8f8e1955445f6dbb25d040be66666afaa20b5504e1a HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Google Update/1.3.35.451;winhttp;cup-ecdsa X-Old-UID: cnt=0 X-Goog-Update-AppId: {430FD4D0-B729-4F61-AA34-91526481799D},{8A69D345-D564-463C-AFF1-A69D9E530F96} X-Goog-Update-Updater: Omaha-1.3.35.451 X-Goog-Update-Interactivity: bg X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Content-Length: 1030 Host: update.googleapis.com
http_request: POST /service/update2 HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache User-Agent: Google Update/1.3.35.451;winhttp X-Old-UID: cnt=0 X-Goog-Update-Updater: Omaha-1.3.35.451 X-Goog-Update-Interactivity: bg X-Last-HR: 0x0 X-Last-HTTP-Status-Code: 0 X-Retry-Count: 0 X-HTTP-Attempts: 1 Content-Length: 1543 Host: update.googleapis.com
Reads data out of its own binary image
self_read: process: GoogleUpdate.exe, pid: 1516, offset: 0x00000000, length: 0x000261c8
CAPE extracted potentially suspicious content
q2w0yYbvMGBN.exe: Unpacked Shellcode
q2w0yYbvMGBN.exe: Loki Payload: 32-bit executable
q2w0yYbvMGBN.exe: Loki
q2w0yYbvMGBN.exe: Unpacked Shellcode
q2w0yYbvMGBN.exe: Unpacked Shellcode
Drops a binary and executes it
binary: C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe
Multiple direct IP connections
direct_ip_connections: Made direct connections to 6 unique IP addresses
HTTP traffic contains suspicious features which may be indicative of malware related traffic
post_no_referer: HTTP traffic contains a POST request with no referer header
http_version_old: HTTP traffic uses version 1.0
suspicious_request: http://admindepartment.ir/kenlaw/five/fre.php
Queries or connects to DNS-Over-HTTPS/DNS-Over-TLS domain or IP address
ip: 1.1.1.1
Performs some HTTP requests
url: http://admindepartment.ir/kenlaw/five/fre.php
The binary contains an unknown PE section name indicative of packing
unknown section: name: CODE, entropy: 6.52, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00061a00, virtual_size: 0x00061874
unknown section: name: DATA, entropy: 5.02, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0000b000, virtual_size: 0x0000ae28
unknown section: name: BSS, entropy: 0.00, characteristics: IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x00000000, virtual_size: 0x00000bf9
The binary likely contains encrypted or compressed data.
section: name: .rsrc, entropy: 7.03, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ, raw_size: 0x00028800, virtual_size: 0x00028780
Authenticode signature is invalid
authenticode error: No signature found. SignTool Error File not valid C\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN
Uses Windows utilities for basic functionality
command: "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNS40NTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNS40NTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkEwNEEyN0UtRDk1RS00RDQ0LTgwRUItMDVDOEU5MjRDQzM0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxNDIwQzEyQS0zNUZCLTRGQkItQTA2Mi0zNkUyNTk5OTgwQjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIwIiBzc2U0Mj0iMCIgYXZ4PSIwIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNS40NTEiIG5leHR2ZXJzaW9uPSIxLjMuMzUuNDUyIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjIiIGlpZD0ie0EwMjVGQzM5LURDODEtQjMwQy04NzlCLTNBODU4MkJFNzVBQn0iIGNvaG9ydD0iMTo5Y286IiBjb2hvcnRuYW1lPSJFdmVyeW9uZSBFbHNlIj48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL3JlZGlyZWN0b3IuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL3VwZGF0ZTIvQU9WZTk4YTNmaTNvSUE1Q2ZUbDNpYmNfMS4zLjM1LjQ1Mi9Hb29nbGVVcGRhdGVTZXR1cC5leGUiIGRvd25sb2FkZWQ9IjEyOTU1NzYiIHRvdGFsPSIxMjk1NTc2IiBkb3dubG9hZF90aW1lX21zPSI0MjUyOSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iODEuMC40MDQ0LjExMyIgbmV4dHZlcnNpb249IiIgYXA9InN0YWJsZS1hcmNoX3g4Ni1zdGF0c2RlZl8wIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjIiIGlpZD0ie0EwMjVGQzM5LURDODEtQjMwQy04NzlCLTNBODU4MkJFNzVBQn0iPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSI5IiBlcnJvcmNvZGU9Ii0xNjA2MjE5NzQ4IiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
command: C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNS40NTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNS40NTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkEwNEEyN0UtRDk1RS00RDQ0LTgwRUItMDVDOEU5MjRDQzM0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxNDIwQzEyQS0zNUZCLTRGQkItQTA2Mi0zNkUyNTk5OTgwQjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIwIiBzc2U0Mj0iMCIgYXZ4PSIwIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNS40NTEiIG5leHR2ZXJzaW9uPSIxLjMuMzUuNDUyIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjIiIGlpZD0ie0EwMjVGQzM5LURDODEtQjMwQy04NzlCLTNBODU4MkJFNzVBQn0iIGNvaG9ydD0iMTo5Y286IiBjb2hvcnRuYW1lPSJFdmVyeW9uZSBFbHNlIj48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL3JlZGlyZWN0b3IuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL3VwZGF0ZTIvQU9WZTk4YTNmaTNvSUE1Q2ZUbDNpYmNfMS4zLjM1LjQ1Mi9Hb29nbGVVcGRhdGVTZXR1cC5leGUiIGRvd25sb2FkZWQ9IjEyOTU1NzYiIHRvdGFsPSIxMjk1NTc2IiBkb3dubG9hZF90aW1lX21zPSI0MjUyOSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iODEuMC40MDQ0LjExMyIgbmV4dHZlcnNpb249IiIgYXA9InN0YWJsZS1hcmNoX3g4Ni1zdGF0c2RlZl8wIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjIiIGlpZD0ie0EwMjVGQzM5LURDODEtQjMwQy04NzlCLTNBODU4MkJFNzVBQn0iPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSI5IiBlcnJvcmNvZGU9Ii0xNjA2MjE5NzQ4IiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
Behavioural detection: Injection (Process Hollowing)
Injection: q2w0yYbvMGBN.exe(1156) -> q2w0yYbvMGBN.exe(3360)
Executed a process and injected code into it, probably while unpacking
Injection: q2w0yYbvMGBN.exe(1156) -> q2w0yYbvMGBN.exe(3360)
Deletes its original binary from disk
Behavioural detection: Injection (inter-process)
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: services.exe (472) called API GetSystemTimeAsFileTime 599681 times
Steals private information from local Internet browsers
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
file: C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
file: C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
A process attempted to collect browser passwords
Process: q2w0yYbvMGBN.exe (3360)
Spoofs its process name and/or associated pathname to appear as a legitimate process
original_name: q2w0yYbvMGBN.exe
original_path: C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.exe
modified_name: q2w0yybvmgbn.exe
modified_path: C:\Users\Louise\AppData\Local\Temp\q2w0yybvmgbn.exe
CAPE detected the Loki malware family
File has been identified by 29 Antiviruses on VirusTotal as malicious
Bkav: W32.AIDetectVM.malwareB
FireEye: Generic.mg.f61c6a4a29390cc4
K7AntiVirus: Trojan ( 005680341 )
K7GW: Trojan ( 005680341 )
Cybereason: malicious.d87ddc
Invincea: heuristic
BitDefenderTheta: Gen:[email protected]
F-Prot: W32/Injector.ABY.gen!Eldorado
Symantec: ML.Attribute.HighConfidence
APEX: Malicious
Kaspersky: UDS:DangerousObject.Multi.Generic
Rising: Malware.Heuristic!ET#100% (RDMK:cmRtazoDe8wB2rslgGofobNdN7P7)
McAfee-GW-Edition: BehavesLike.Win32.Fareit.jh
Fortinet: W32/Injector.ELZG!tr
Trapmine: suspicious.low.ml.score
Cyren: W32/Injector.ABY.gen!Eldorado
eGambit: Unsafe.AI_Score_72%
Endgame: malicious (high confidence)
Microsoft: Trojan:Win32/Wacatac.C!ml
ZoneAlarm: UDS:DangerousObject.Multi.Generic
Cynet: Malicious (score: 100)
AhnLab-V3: Suspicious/Win.Delphiless.X2066
Acronis: suspicious
McAfee: Fareit-FTB!F61C6A4A2939
ESET-NOD32: a variant of Win32/Injector.EMJE
SentinelOne: DFI - Suspicious PE
MaxSecure: Trojan.Malware.300983.susgen
CrowdStrike: win/malicious_confidence_80% (D)
Qihoo-360: HEUR/QVM05.1.166F.Malware.Gen
Creates a copy of itself
copy: C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
Harvests credentials from local FTP client softwares
file: C:\Users\Louise\AppData\Roaming\FileZilla\sitemanager.xml
file: C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
file: C:\Users\Louise\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
file: C:\Program Files (x86)\FTPGetter\Profile\servers.xml
file: C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
file: C:\Users\Louise\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
key: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
key: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
key: HKEY_CURRENT_USER\Software\Ghisler\Total Commander
key: HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
Harvests information related to installed instant messenger clients
file: C:\Users\Louise\AppData\Roaming\.purple\accounts.xml
Harvests information related to installed mail clients
file: C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
key: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
key: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
key: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
Attempts to create or modify system certificates
Collects information to fingerprint the system
Anomalous binary characteristics
anomaly: Timestamp on binary predates the release date of the OS version it requires by at least a year

Screenshots


Hosts

Direct IP Country Name
Y 8.8.8.8 [VT] United States
Y 72.21.91.29 [VT] United States
Y 51.137.137.111 [VT] United Kingdom
N 194.180.224.87 [VT] unknown
Y 172.217.2.99 [VT] United States
Y 13.107.42.23 [VT] United States
Y 1.1.1.1 [VT] Australia

DNS

Name Response Post-Analysis Lookup
admindepartment.ir [VT] A 194.180.224.87 [VT] 194.180.224.87 [VT]

Summary

C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.ENU
C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.ENU.DLL
C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.EN
C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.EN.DLL
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Users\Louise\AppData\Local\Temp\mozglue.dll
C:\Windows\System32\mozglue.dll
C:\Windows\system\mozglue.dll
C:\Windows\mozglue.dll
C:\Python27\mozglue.dll
C:\Python27\Scripts\mozglue.dll
C:\Windows\System32\wbem\mozglue.dll
C:\Windows\System32\WindowsPowerShell\v1.0\mozglue.dll
C:\ProgramData\chocolatey\bin\mozglue.dll
C:\Users\Louise\AppData\Local\Programs\Python\Python38-32\Scripts\mozglue.dll
C:\Users\Louise\AppData\Local\Programs\Python\Python38-32\mozglue.dll
C:\Users\Louise\AppData\Roaming\Python\Scripts\mozglue.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Users\Louise\AppData\Local\Temp\VERSION.dll
C:\Windows\System32\version.dll
C:\Users\Louise\AppData\Local\Temp\dbghelp.dll
C:\Windows\System32\dbghelp.dll
C:\Users\Louise\AppData\Local\Temp\MSVCP140.dll
C:\Windows\System32\msvcp140.dll
C:\Users\Louise\AppData\Local\Temp\VCRUNTIME140.dll
C:\Windows\System32\VCRUNTIME140.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-runtime-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\ucrtbase.DLL
C:\Windows\System32\ucrtbase.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-timezone-l1-1-0.dll
C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-file-l2-1-0.dll
C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-localization-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-processthreads-l1-1-1.dll
C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-core-file-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-string-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-heap-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-stdio-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-convert-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-locale-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-math-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-time-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-environment-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\api-ms-win-crt-utility-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
C:\Users\Louise\AppData\Local\Temp\WINMM.dll
C:\Windows\System32\winmm.dll
C:\Users\Louise\AppData\Local\Temp\WSOCK32.dll
C:\Windows\System32\wsock32.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Windows\System32\api-ms-win-core-sysinfo-l1-2-1.DLL
C:\
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db-journal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db-wal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db-journal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db-wal
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\nssckbi.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.sqlite
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons.txt
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons2.txt
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\signons3.txt
C:\Program Files\NETGATE\Black Hawk
C:\Program Files (x86)\Lunascape\Lunascape6\plugins\{9BDD5314-20A6-4d98-AB30-8325A95771EE}
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Dragon\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalComodo\Dragon\Login Data
C:\Users\Louise\AppData\LocalComodo\Dragon\Default\Login Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\MapleStudio\ChromePlus\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalMapleStudio\ChromePlus\Login Data
C:\Users\Louise\AppData\LocalMapleStudio\ChromePlus\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Nichrome\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Nichrome\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalNichrome\Login Data
C:\Users\Louise\AppData\LocalNichrome\Default\Login Data
C:\Users\Louise\AppData\Local\RockMelt\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\RockMelt\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalRockMelt\Login Data
C:\Users\Louise\AppData\LocalRockMelt\Default\Login Data
C:\Users\Louise\AppData\Local\Spark\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Spark\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalSpark\Login Data
C:\Users\Louise\AppData\LocalSpark\Default\Login Data
C:\Users\Louise\AppData\Local\Chromium\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Chromium\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalChromium\Login Data
C:\Users\Louise\AppData\LocalChromium\Default\Login Data
C:\Users\Louise\AppData\Local\Titan Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Titan Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalTitan Browser\Login Data
C:\Users\Louise\AppData\LocalTitan Browser\Default\Login Data
C:\Users\Louise\AppData\Local\Torch\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Torch\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalTorch\Login Data
C:\Users\Louise\AppData\LocalTorch\Default\Login Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Yandex\YandexBrowser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalYandex\YandexBrowser\Login Data
C:\Users\Louise\AppData\LocalYandex\YandexBrowser\Default\Login Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Epic Privacy Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalEpic Privacy Browser\Login Data
C:\Users\Louise\AppData\LocalEpic Privacy Browser\Default\Login Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\CocCoc\Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCocCoc\Browser\Login Data
C:\Users\Louise\AppData\LocalCocCoc\Browser\Default\Login Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Vivaldi\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalVivaldi\Login Data
C:\Users\Louise\AppData\LocalVivaldi\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Chromodo\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Comodo\Chromodo\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalComodo\Chromodo\Login Data
C:\Users\Louise\AppData\LocalComodo\Chromodo\Default\Login Data
C:\Users\Louise\AppData\Local\Superbird\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Superbird\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalSuperbird\Login Data
C:\Users\Louise\AppData\LocalSuperbird\Default\Login Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Coowon\Coowon\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCoowon\Coowon\Login Data
C:\Users\Louise\AppData\LocalCoowon\Coowon\Default\Login Data
C:\Users\Louise\AppData\Local\Mustang Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Mustang Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalMustang Browser\Login Data
C:\Users\Louise\AppData\LocalMustang Browser\Default\Login Data
C:\Users\Louise\AppData\Local\360Browser\Browser\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\360Browser\Browser\User Data\Default\Web Data
C:\Users\Louise\AppData\Local360Browser\Browser\Login Data
C:\Users\Louise\AppData\Local360Browser\Browser\Default\Login Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\CatalinaGroup\Citrio\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalCatalinaGroup\Citrio\Login Data
C:\Users\Louise\AppData\LocalCatalinaGroup\Citrio\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome SxS\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Google\Chrome SxS\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalGoogle\Chrome SxS\Login Data
C:\Users\Louise\AppData\LocalGoogle\Chrome SxS\Default\Login Data
C:\Users\Louise\AppData\Local\Orbitum\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Orbitum\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalOrbitum\Login Data
C:\Users\Louise\AppData\LocalOrbitum\Default\Login Data
C:\Users\Louise\AppData\Local\Iridium\User Data\Default\Login Data
C:\Users\Louise\AppData\Local\Iridium\User Data\Default\Web Data
C:\Users\Louise\AppData\LocalIridium\Login Data
C:\Users\Louise\AppData\LocalIridium\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\Login Data
C:\Users\Louise\AppData\Roaming\Opera\Opera Next\data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\Login Data
C:\Users\Louise\AppData\Roaming\Opera Software\Opera Stable\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir\setting\modules\ChromiumViewer\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\User Data\Default\Web Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Login Data
C:\Users\Louise\AppData\Roaming\Fenrir Inc\Sleipnir5\setting\modules\ChromiumViewer\Default\Login Data
C:\Users\Louise\AppData\Local\QupZilla\profiles\default\browsedata.db
C:\Users\Louise\AppData\Roaming\Opera
C:\Users\Louise\AppData\Roaming\.purple\accounts.xml
C:\Users\Louise\Documents\SuperPutty
C:\Program Files (x86)\FTPShell\ftpshell.fsi
C:\Users\Louise\AppData\Roaming\Notepad++\plugins\config\NppFTP\NppFTP.xml
C:\Program Files (x86)\oZone3D\MyFTP\myftp.ini
C:\Users\Louise\AppData\Roaming\FTPBox\profiles.conf
C:\Program Files (x86)\Sherrod Computers\sherrod FTP\favorites
C:\Program Files (x86)\FTP Now\sites.xml
C:\Program Files (x86)\NexusFile\userdata\ftpsite.ini
C:\Users\Louise\AppData\Roaming\NexusFile\ftpsite.ini
C:\Users\Louise\Documents\NetSarang\Xftp\Sessions
C:\Users\Louise\AppData\Roaming\NetSarang\Xftp\Sessions
C:\Program Files (x86)\EasyFTP\data
C:\Users\Louise\AppData\Roaming\SftpNetDrive
C:\Program Files (x86)\AbleFTP7\encPwd.jsd
C:\Program Files (x86)\AbleFTP7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP8\encPwd.jsd
C:\Program Files (x86)\AbleFTP8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP9\encPwd.jsd
C:\Program Files (x86)\AbleFTP9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP10\encPwd.jsd
C:\Program Files (x86)\AbleFTP10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP11\encPwd.jsd
C:\Program Files (x86)\AbleFTP11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP12\encPwd.jsd
C:\Program Files (x86)\AbleFTP12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP13\encPwd.jsd
C:\Program Files (x86)\AbleFTP13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\AbleFTP14\encPwd.jsd
C:\Program Files (x86)\AbleFTP14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\AbleFTP14\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp7\encPwd.jsd
C:\Program Files (x86)\JaSFtp7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp8\encPwd.jsd
C:\Program Files (x86)\JaSFtp8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp9\encPwd.jsd
C:\Program Files (x86)\JaSFtp9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp10\encPwd.jsd
C:\Program Files (x86)\JaSFtp10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp11\encPwd.jsd
C:\Program Files (x86)\JaSFtp11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp12\encPwd.jsd
C:\Program Files (x86)\JaSFtp12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp13\encPwd.jsd
C:\Program Files (x86)\JaSFtp13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\JaSFtp14\encPwd.jsd
C:\Program Files (x86)\JaSFtp14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\JaSFtp14\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize7\encPwd.jsd
C:\Program Files (x86)\Automize7\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize7\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize8\encPwd.jsd
C:\Program Files (x86)\Automize8\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize8\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize9\encPwd.jsd
C:\Program Files (x86)\Automize9\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize9\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize10\encPwd.jsd
C:\Program Files (x86)\Automize10\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize10\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize11\encPwd.jsd
C:\Program Files (x86)\Automize11\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize11\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize12\encPwd.jsd
C:\Program Files (x86)\Automize12\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize12\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize13\encPwd.jsd
C:\Program Files (x86)\Automize13\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize13\data\settings\ftpProfiles-j.jsd
C:\Program Files (x86)\Automize14\encPwd.jsd
C:\Program Files (x86)\Automize14\data\settings\sshProfiles-j.jsd
C:\Program Files (x86)\Automize14\data\settings\ftpProfiles-j.jsd
C:\Users\Louise\AppData\Roaming\Cyberduck
C:\Users\Louise\AppData\Roaming\iterate_GmbH
C:\Users\Louise\.config\fullsync\profiles.xml
C:\Users\Louise\AppData\Roaming\FTPInfo\ServerList.xml
C:\Users\Louise\AppData\Roaming\FTPInfo\ServerList.cfg
C:\Program Files (x86)\FileZilla\Filezilla.xml
C:\Users\Louise\AppData\Roaming\FileZilla\filezilla.xml
C:\Users\Louise\AppData\Roaming\FileZilla\recentservers.xml
C:\Users\Louise\AppData\Roaming\FileZilla\sitemanager.xml
C:\Program Files (x86)\Staff-FTP\sites.ini
C:\Users\Louise\AppData\Roaming\BlazeFtp\site.dat
C:\Program Files (x86)\Fastream NETFile\My FTP Links
C:\Program Files (x86)\GoFTP\settings\Connections.txt
C:\Users\Louise\AppData\Roaming\Estsoft\ALFTP\ESTdb2.dat
C:\Program Files (x86)\DeluxeFTP\sites.xml
C:\Windows\wcx_ftp.ini
C:\Users\Louise\AppData\Roaming\wcx_ftp.ini
C:\Users\Louise\wcx_ftp.ini
C:\Users\Louise\AppData\Roaming\GHISLER\wcx_ftp.ini
C:\Program Files (x86)\FTPGetter\Profile\servers.xml
C:\Users\Louise\AppData\Roaming\FTPGetter\servers.xml
C:\Program Files (x86)\WS_FTP\WS_FTP.INI
C:\Windows\WS_FTP.INI
C:\Users\Louise\AppData\Roaming\Ipswitch
C:\Users\Louise\site.xml
C:\Users\Louise\AppData\Local\PokerStars*
C:\Users\Louise\AppData\Local\ExpanDrive
C:\Users\Louise\AppData\Roaming\Steed\bookmarks.txt
C:\Users\Louise\AppData\Roaming\FlashFXP
C:\ProgramData\FlashFXP
C:\Users\Louise\AppData\Local\INSoftware\NovaFTP\NovaFTP.db
C:\Users\Louise\AppData\Roaming\NetDrive\NDSites.ini
C:\Users\Louise\AppData\Roaming\NetDrive2\drives.dat
C:\ProgramData\NetDrive2\drives.dat
C:\Users\Louise\AppData\Roaming\SmartFTP
C:\Users\Louise\AppData\Roaming\Far Manager\Profile\PluginsData\42E4AEB1-A230-44F4-B33C-F195BB654931.db
C:\Users\Louise\Documents\*.tlp
C:\Users\Louise\Documents\*.bscp
C:\Users\Louise\Documents\*.vnc
C:\Users\Louise\Desktop\*.vnc
C:\Users\Louise\Documents\mSecure
C:\ProgramData\Syncovery
C:\Program Files (x86)\FreshWebmaster\FreshFTP\FtpSites.SMF
C:\Users\Louise\AppData\Roaming\BitKinex\bitkinex.ds
C:\Users\Louise\AppData\Roaming\UltraFXP\sites.xml
C:\Users\Louise\AppData\Roaming\FTP Now\sites.xml
C:\Program Files (x86)\Odin Secure FTP Expert\QFDefault.QFQ
C:\Program Files (x86)\Odin Secure FTP Expert\SiteInfo.QFP
C:\Program Files (x86)\Mozilla Thunderbird
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Program Files (x86)\Mozilla Thunderbird\sqlite3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozsqlite3.dll
C:\Users\Louise\AppData\Roaming\Thunderbird\profiles.ini
C:\Program Files (x86)\Foxmail\mail
C:\Foxmail*
C:\Users\Louise\AppData\Roaming\Pocomail\accounts.ini
C:\Users\Louise\Documents\Pocomail\accounts.ini
C:\Users\Louise\AppData\Roaming\GmailNotifierPro\ConfigData.xml
C:\Users\Louise\AppData\Roaming\DeskSoft\CheckMail
C:\Program Files (x86)\WinFtp Client\Favorites.dat
C:\Windows\32BitFtp.TMP
C:\Windows\32BitFtp.ini
C:\FTP Navigator\Ftplist.txt
C:\Softwarenetz\Mailing\Daten\mailing.vdt
C:\Users\Louise\AppData\Roaming\Opera Mail\Opera Mail\wand.dat
C:\Users\Louise\Documents\*Mailbox.ini
C:\Users\Louise\Documents\yMail2\POP3.xml
C:\Users\Louise\Documents\yMail2\SMTP.xml
C:\Users\Louise\Documents\yMail2\Accounts.xml
C:\Users\Louise\Documents\yMail\ymail.ini
C:\Users\Louise\AppData\Roaming\TrulyMail\Data\Settings\user.config
C:\Users\Louise\Documents\*.spn
C:\Users\Louise\Desktop\*.spn
C:\Users\Louise\AppData\Roaming\To-Do DeskList\tasks.db
C:\Users\Louise\AppData\Roaming\stickies\images
C:\Users\Louise\AppData\Roaming\stickies\rtf
C:\Users\Louise\AppData\Roaming\NoteFly\notes
C:\Users\Louise\AppData\Roaming\Conceptworld\Notezilla\Notes8.db
C:\Users\Louise\AppData\Roaming\Microsoft\Sticky Notes\StickyNotes.snt
C:\Users\Louise\Documents
C:\Users\Louise\Documents\*.kdbx
C:\Users\Louise\Desktop
C:\Users\Louise\Desktop\*.kdbx
C:\Users\Louise\Documents\*.kdb
C:\Users\Louise\Desktop\*.kdb
C:\Users\Louise\Documents\Enpass
C:\Users\Louise\Documents\My RoboForm Data
C:\Users\Louise\Documents\1Password
C:\Users\Louise\AppData\Local\Temp\Mikrotik\Winbox
C:\Users\Louise\AppData\Local\Temp\NETAPI32.DLL
C:\Windows\System32\netapi32.dll
C:\Users\Louise\AppData\Local\Temp\netutils.dll
C:\Windows\System32\netutils.dll
C:\Users\Louise\AppData\Local\Temp\srvcli.dll
C:\Windows\System32\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Roaming\Microsoft\Credentials
C:\Users\Louise\AppData\Roaming\Microsoft\Credentials\*
C:\Users\Louise\AppData\Local\Microsoft\Credentials
C:\Users\Louise\AppData\Local\Microsoft\Credentials\*
C:\Users\Louise\AppData\Local\Temp\q2w0yybvmgbn.exe
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
C:\Windows\sysnative\LogFiles\Scm\2f57269b-1e09-4e2d-ab1e-b0fdac7d279c
C:\Windows\Temp
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Windows\System32\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\System32\api-ms-win-core-localization-l1-2-1.DLL
C:\Program Files (x86)\Google\Update\goopdate.dll
C:\Program Files (x86)\Google\Update\1.3.35.451\goopdate.dll
C:\Windows\System32\IPHLPAPI.DLL
C:\Windows\System32\winnsi.dll
C:\Windows\System32\msi.dll
C:\Windows\System32\userenv.dll
C:\Windows\System32\profapi.dll
C:\Windows\System32\wtsapi32.dll
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe.Local\
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
C:\Windows\System32\msimg32.dll
C:\Windows\System32\uxtheme.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\GoogleUpdate.ini
C:\Windows\System32
C:\Program Files (x86)
C:\Program Files (x86)\Google
C:\Program Files (x86)\Google\CrashReports
\??\pipe\GoogleCrashServices\S-1-5-18
\Device\KsecDD
C:\Program Files (x86)\Google\Update\1.3.35.451
C:\Program Files (x86)\Google\Update\1.3.35.451\goopdateres_en.dll
C:\Program Files (x86)\Google\Policies
C:\Program Files (x86)\Google\Update\1.3.35.451\psmachine.dll
C:\Program Files (x86)\Google\Update
C:\Program Files (x86)\Google\Update\Download
C:\Program Files (x86)\Google\Update\Download\*
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\*
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\81.0.4044.113\*
C:\Program Files (x86)\Google\Update\Install
C:\Program Files (x86)\Google\Update\Install\*.*
C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\*
C:\Windows\System32\winhttp.dll
C:\Windows\System32\webio.dll
C:\Windows\System32\p2pcollab.dll
C:\Windows\System32\qagentrt.dll
C:\Windows\System32\dnsapi.dll
C:\Users\Louise\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\*
C:\Users\Louise\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\*
C:\Users\Louise\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\*
\??\PIPE\wkssvc
C:\DosDevices\pipe\
C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.35.452\GoogleUpdateSetup.exe
C:\Users\Louise\AppData\Local\Temp
C:\Users
C:\Users\Louise
C:\Users\Louise\AppData
C:\Users\Louise\AppData\Local
C:\Users\Louise\AppData\Local\Temp\
C:\Users\Louise\AppData\Local\Temp\{451D95A8-DB86-40A5-9A81-678C947DCCC9}-GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}
C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.35.452
C:\Program Files (x86)\Google\Update\Install\{26FAD9E2-9546-4920-A06C-6EBFB87AF4DF}
C:\Program Files (x86)\Google\Update\Install\{26FAD9E2-9546-4920-A06C-6EBFB87AF4DF}\GoogleUpdateSetup.exe
\??\MountPointManager
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\Windows\System32\api-ms-win-appmodel-runtime-l1-1-1.DLL
C:\Windows\System32\ext-ms-win-kernel32-package-current-l1-1-0.DLL
C:\Program Files (x86)\Google\Temp
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp
C:\Program Files (x86)\Google\Temp\GUTC9E8.tmp
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdate.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdate.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateHelper.msi
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateBroker.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateOnDemand.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateComRegisterShell64.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psmachine.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psmachine_64.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psuser.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psuser_64.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleCrashHandler64.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateCore.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_am.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ar.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_bg.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_bn.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ca.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_cs.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_da.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_de.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_el.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_en.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_en-GB.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_es.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_es-419.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_et.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fa.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fil.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_gu.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hu.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_id.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_is.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_it.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_iw.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ja.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_kn.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ko.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_lt.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_lv.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ml.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_mr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ms.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_nl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_no.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pt-BR.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pt-PT.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ro.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ru.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sk.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sv.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sw.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ta.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_te.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_th.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_tr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_uk.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ur.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_vi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_zh-CN.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_zh-TW.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdate.exe.Local\
C:\Program Files (x86)\Google\Update\1.3.35.452
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdate.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_am.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ar.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bg.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bn.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ca.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_cs.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_da.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_de.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_el.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en-GB.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es-419.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_et.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fa.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fil.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_gu.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hu.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_id.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_is.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_it.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_iw.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ja.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_kn.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ko.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lt.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lv.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ml.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_mr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ms.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_nl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_no.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-BR.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-PT.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ro.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ru.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sk.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sv.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sw.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ta.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_te.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_th.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_tr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_uk.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ur.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_vi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-CN.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-TW.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateHelper.msi
C:\Program Files (x86)\Google\Update\1.3.35.452\psuser.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psuser_64.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine_64.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe.old
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe
C:\Windows\System32\tzres.dll
C:\Windows\sysnative\Tasks
C:\Windows\sysnative\Tasks\*
C:\Windows\sysnative\Tasks\AutoKMS
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\sysnative\Tasks\GoogleUpdateTaskMachineCore
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
C:\Windows\sysnative\Tasks\GoogleUpdateTaskMachineUA
C:\Windows\appcompat\Programs\RecentFileCache.bcf
C:\Windows\AppPatch\AppPatch64\sysmain.sdb
C:\Program Files (x86)\Google\Update\1.3.35.452\
C:\Windows\SysWOW64\cmd.exe
C:\Windows
C:\Windows\SysWOW64
C:\Windows\AppPatch\sysmain.sdb
C:\Windows\SysWOW64\
C:\Windows\SysWOW64\*.*
C:\Windows\SysWOW64\en-US\cmd.exe.mui
C:\Windows\SysWOW64\ui\SwDRM.dll
C:\Windows\sysnative\api-ms-win-core-fibers-l1-1-1.DLL
C:\Windows\sysnative\api-ms-win-core-localization-l1-2-1.DLL
C:\Windows\sysnative\netapi32.dll
C:\Windows\sysnative\netutils.dll
C:\Windows\sysnative\srvcli.dll
C:\Program Files (x86)\Mozilla Firefox\nss3.dll
C:\Program Files (x86)\Mozilla Firefox\mozglue.dll
C:\Windows\System32\version.dll
C:\Windows\System32\dbghelp.dll
C:\Windows\System32\msvcp140.dll
C:\Windows\System32\VCRUNTIME140.dll
C:\Windows\System32\api-ms-win-crt-runtime-l1-1-0.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\api-ms-win-core-timezone-l1-1-0.dll
C:\Windows\System32\api-ms-win-core-file-l2-1-0.dll
C:\Windows\System32\api-ms-win-core-localization-l1-2-0.dll
C:\Windows\System32\api-ms-win-core-processthreads-l1-1-1.dll
C:\Windows\System32\api-ms-win-core-file-l1-2-0.dll
C:\Windows\System32\api-ms-win-crt-string-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-heap-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-stdio-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-convert-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-locale-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-math-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-multibyte-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-time-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-filesystem-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-environment-l1-1-0.dll
C:\Windows\System32\api-ms-win-crt-utility-l1-1-0.dll
C:\Windows\System32\winmm.dll
C:\Windows\System32\wsock32.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Program Files (x86)\Mozilla Firefox\softokn3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\pkcs11.txt
C:\Program Files (x86)\Mozilla Firefox\freebl3.dll
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\cert9.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\key4.db
C:\Users\Louise\AppData\Roaming\Mozilla\Firefox\Profiles\0f9yudun.default\logins.json
C:\Users\Louise\AppData\Local\Google\Chrome\User Data\Default\Login Data
C:\Program Files (x86)\Mozilla Thunderbird\nss3.dll
C:\Program Files (x86)\Mozilla Thunderbird\mozglue.dll
C:\Windows\System32\netapi32.dll
C:\Windows\System32\netutils.dll
C:\Windows\System32\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Windows\sysnative\LogFiles\Scm\2f57269b-1e09-4e2d-ab1e-b0fdac7d279c
C:\Windows\sysnative\LogFiles\Scm\eaca24ff-236c-401d-a1e7-b3d5267b8a50
C:\Program Files (x86)\Google\Update\1.3.35.451\goopdate.dll
C:\Windows\System32\IPHLPAPI.DLL
C:\Windows\System32\winnsi.dll
C:\Windows\System32\msi.dll
C:\Windows\System32\userenv.dll
C:\Windows\System32\profapi.dll
C:\Windows\System32\wtsapi32.dll
C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
C:\Windows\System32\msimg32.dll
C:\Windows\System32\uxtheme.dll
C:\Windows\Globalization\Sorting\sortdefault.nls
C:\Program Files (x86)\Google\CrashReports
\??\pipe\GoogleCrashServices\S-1-5-18
\Device\KsecDD
C:\Program Files (x86)\Google\Update\1.3.35.451\goopdateres_en.dll
C:\Program Files (x86)\Google\Update\1.3.35.451\psmachine.dll
C:\Windows\System32\winhttp.dll
C:\Windows\System32\webio.dll
\??\PIPE\wkssvc
C:\Users\Louise\AppData\Local\Temp\{451D95A8-DB86-40A5-9A81-678C947DCCC9}-GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.35.452\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp
C:\Program Files (x86)\Google\Temp\GUTC9E8.tmp
C:\Program Files (x86)\Google\Update\Install\{26FAD9E2-9546-4920-A06C-6EBFB87AF4DF}\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdate.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_en.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdate.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdate.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateCore.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleCrashHandler64.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateComRegisterShell64.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_am.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_am.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ar.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ar.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_bg.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bg.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_bn.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bn.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ca.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ca.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_cs.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_cs.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_da.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_da.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_de.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_de.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_el.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_el.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_en-GB.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en-GB.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_es.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_es-419.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es-419.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_et.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_et.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fa.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fa.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fil.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fil.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_gu.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_gu.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hu.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hu.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_id.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_id.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_is.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_is.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_it.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_it.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_iw.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_iw.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ja.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ja.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_kn.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_kn.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ko.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ko.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_lt.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lt.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_lv.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lv.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ml.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ml.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_mr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_mr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ms.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ms.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_nl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_nl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_no.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_no.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pt-BR.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-BR.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pt-PT.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-PT.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ro.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ro.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ru.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ru.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sk.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sk.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sv.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sv.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sw.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sw.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ta.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ta.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_te.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_te.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_th.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_th.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_tr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_tr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_uk.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_uk.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ur.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ur.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_vi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_vi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_zh-CN.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-CN.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_zh-TW.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-TW.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateHelper.msi
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateHelper.msi
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psuser.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psuser.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psuser_64.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psuser_64.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psmachine.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psmachine_64.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine_64.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateBroker.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateOnDemand.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe
C:\Windows\System32\tzres.dll
C:\Windows\appcompat\Programs\RecentFileCache.bcf
C:\Windows\AppPatch\AppPatch64\sysmain.sdb
C:\Program Files (x86)\Google\Update\1.3.35.452\
C:\Windows\SysWOW64\cmd.exe
C:\Windows\AppPatch\sysmain.sdb
C:\Windows\SysWOW64\
C:\Windows\SysWOW64\en-US\cmd.exe.mui
C:\Windows\sysnative\netapi32.dll
C:\Windows\sysnative\netutils.dll
C:\Windows\sysnative\srvcli.dll
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.exe
\??\pipe\GoogleCrashServices\S-1-5-18
\??\PIPE\wkssvc
C:\Users\Louise\AppData\Local\Temp\{451D95A8-DB86-40A5-9A81-678C947DCCC9}-GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.35.452\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Update\Install\{26FAD9E2-9546-4920-A06C-6EBFB87AF4DF}\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Temp\GUTC9E8.tmp
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdate.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdate.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateHelper.msi
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateBroker.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateOnDemand.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateComRegisterShell64.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psmachine.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psmachine_64.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psuser.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\psuser_64.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleCrashHandler64.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateCore.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_am.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ar.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_bg.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_bn.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ca.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_cs.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_da.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_de.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_el.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_en.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_en-GB.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_es.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_es-419.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_et.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fa.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fil.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_fr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_gu.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_hu.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_id.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_is.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_it.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_iw.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ja.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_kn.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ko.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_lt.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_lv.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ml.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_mr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ms.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_nl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_no.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pt-BR.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_pt-PT.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ro.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ru.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sk.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sl.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sv.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_sw.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ta.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_te.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_th.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_tr.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_uk.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_ur.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_vi.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_zh-CN.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\goopdateres_zh-TW.dll
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdate.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdate.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateCore.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleCrashHandler64.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_am.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ar.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bg.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_bn.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ca.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_cs.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_da.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_de.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_el.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_en-GB.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_es-419.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_et.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fa.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fil.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_fr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_gu.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_hu.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_id.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_is.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_it.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_iw.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ja.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_kn.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ko.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lt.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_lv.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ml.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_mr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ms.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_nl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_no.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-BR.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_pt-PT.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ro.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ru.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sk.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sl.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sv.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_sw.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ta.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_te.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_th.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_tr.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_uk.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_ur.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_vi.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-CN.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\goopdateres_zh-TW.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateHelper.msi
C:\Program Files (x86)\Google\Update\1.3.35.452\psuser.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psuser_64.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\psmachine_64.dll
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe.old
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateBroker.exe
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateOnDemand.exe
C:\Windows\appcompat\Programs\RecentFileCache.bcf
C:\Users\Louise\AppData\Roaming\E5A3EA\ACE282.lck
C:\Users\Louise\AppData\Local\Temp\q2w0yybvmgbn.exe
C:\Users\Louise\AppData\Local\Temp\{451D95A8-DB86-40A5-9A81-678C947DCCC9}-GoogleUpdateSetup.exe
C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp
C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateSetup.exe
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_CURRENT_USER
DisableUserModeCallbackFilter
HKEY_CURRENT_USER\Software\Borland\Locales
HKEY_LOCAL_MACHINE\Software\Borland\Locales
HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography
\x8ad0\x22dEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main\Install Directory
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\ComodoGroup\IceDragon\Setup
HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\Safari
HKEY_LOCAL_MACHINE\SOFTWARE\K-Meleon
HKEY_LOCAL_MACHINE\SOFTWARE\mozilla.org\SeaMonkey
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\SeaMonkey
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Flock
HKEY_CURRENT_USER\Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2
HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox86
HKEY_LOCAL_MACHINE\SOFTWARE\8pecxstudios\Cyberfox
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Pale Moon
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Waterfox
HKEY_CURRENT_USER\Software\LinasFTP\Site Manager
HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
HKEY_CURRENT_USER\Software\Ghisler\Total Commander
HKEY_CURRENT_USER\Software
HKEY_CURRENT_USER\Software\7-Zip
HKEY_CURRENT_USER\Software\Adobe
HKEY_CURRENT_USER\Software\AppDataLow
HKEY_CURRENT_USER\Software\Clients
HKEY_CURRENT_USER\Software\Google
HKEY_CURRENT_USER\Software\IM Providers
HKEY_CURRENT_USER\Software\JavaSoft
HKEY_CURRENT_USER\Software\Macromedia
HKEY_CURRENT_USER\Software\Microsoft
HKEY_CURRENT_USER\Software\Mozilla
HKEY_CURRENT_USER\Software\Netscape
HKEY_CURRENT_USER\Software\ODBC
HKEY_CURRENT_USER\Software\Piriform
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software\Python
HKEY_CURRENT_USER\Software\WinRAR
HKEY_CURRENT_USER\Software\WinRAR SFX
HKEY_CURRENT_USER\Software\Wow6432Node
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
HKEY_CURRENT_USER\Software\Bitvise\BvSshClient
HKEY_CURRENT_USER\Software\VanDyke\SecureFX
HKEY_LOCAL_MACHINE\Software\NCH Software\Fling\Accounts
HKEY_CURRENT_USER\Software\NCH Software\Fling\Accounts
HKEY_LOCAL_MACHINE\Software\NCH Software\ClassicFTP\FTPAccounts
HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions
HKEY_LOCAL_MACHINE\Software\SimonTatham\PuTTY\Sessions
HKEY_LOCAL_MACHINE\Software\9bis.com\KiTTY\Sessions
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main\Install Directory
HKEY_CURRENT_USER\Software\IncrediMail\Identities
HKEY_LOCAL_MACHINE\Software\IncrediMail\Identities
HKEY_CURRENT_USER\Software\Martin Prikryl
HKEY_LOCAL_MACHINE\Software\Martin Prikryl
HKEY_LOCAL_MACHINE\SOFTWARE\Postbox\Postbox
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\FossaMail
HKEY_CURRENT_USER\Software\WinChips\UserAccounts
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook
HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook
HKEY_CURRENT_USER\SOFTWARE\flaska.net\trojita
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout
HKEY_LOCAL_MACHINE\\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\x41e\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\xfffd\x456\xfffd\x414\xfffd\xfffd\xfffd\xfffd\xfffd\x419\xfffd\xfffd\xfffd\x419\xfffd\xfffd\x44f\xfffd\xfffd
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-18
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\.DEFAULT\Environment
HKEY_USERS\.DEFAULT\Volatile Environment
HKEY_USERS\.DEFAULT\Volatile Environment\0
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\WOW64
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\WOW64
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Description
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\msasn1
HKEY_USERS\.DEFAULT\Control Panel\International
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\Software\Policies\Google\Update\
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\Software\Google\Update\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\OemInstallTime
HKEY_LOCAL_MACHINE\Software\Google\UpdateDev\
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientStateMedium\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\usagestats
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\uid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\eulaaccepted
HKEY_LOCAL_MACHINE\Software\Google\Enrollment\
HKEY_LOCAL_MACHINE\Software\Google\Chrome\Enrollment\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\gupdate_service_name
HKEY_LOCAL_MACHINE\Software\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\OleAut
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\name
HKEY_USERS\
HKEY_USERS\.DEFAULT\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-19\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-19\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-20\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-20\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-18\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\tttoken
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\client
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ping_freshness
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}\name
HKEY_USERS\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\.DEFAULT\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-19\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-19\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-20\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-20\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\dr
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-18\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-18\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\tttoken
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\client
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\UBR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\experiment_labels
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings\{12BA7A40-B22D-4CDD-A4EC-0E3412BABEA0}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{12BA7A40-B22D-4CDD-A4EC-0E3412BABEA0}\PersistedPingString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{12BA7A40-B22D-4CDD-A4EC-0E3412BABEA0}\PersistedPingTime
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{12BA7A40-B22D-4CDD-A4EC-0E3412BABEA0}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\experiment_labels
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\uid-create-time
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\uid-num-rotations
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}
HKEY_CURRENT_USER\Software\Microsoft\windows\CurrentVersion\Internet Settings\Wpad
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05
\xd798\xabEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xd798\xabEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\SOFTWARE\Clients\StartMenuInternet
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Clients\StartMenuInternet\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xd798\xabEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\proxy
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\proxy\source
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurityProviders\Schannel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MUI\StringCacheSettings
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Classes\Local Settings\MuiCache\1e4\52C64B7E
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_CLASSES\Local Settings\MuiCache\1E4\52C64B7E\LanguageList
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_CLASSES\Local Settings\MuiCache\1E4\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_CLASSES\Local Settings\MuiCache\1E4\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crypt32
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertSyncDeltaTime
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\ChainEngine\Config
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MinRsaPubKeyBitLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRsaPubKeyTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartyAfterTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1ThirdPartyAfterTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakRSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakRSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakECDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakECDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\My\PhysicalStores
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\My
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1339698970-4093829097-1161395185-1000
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1339698970-4093829097-1161395185-1000\ProfileImagePath
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\My\
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\My\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\My\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\My\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\My\Keys
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\CA\PhysicalStores
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\CA
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\CA\
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\CA\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\CA\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\CA\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\CA
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\CA\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\CA\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\CA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\CA\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Disallowed
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPublisher\Safer
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Disallowed\
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\Disallowed
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2A83E9020591A55FC6DDAD3FB102794C52B24E70
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2A83E9020591A55FC6DDAD3FB102794C52B24E70\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\3A850044D8A195CD401A680C012CB0A3B5F8DC08
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\3A850044D8A195CD401A680C012CB0A3B5F8DC08\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\471C949A8143DB5AD5CDF1C972864A2504FA23C9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\471C949A8143DB5AD5CDF1C972864A2504FA23C9\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\6431723036FD26DEA502792FA595922493030F97
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\6431723036FD26DEA502792FA595922493030F97\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\80962AE4D6C5B442894E95A13E4A699E07D694CF
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\80962AE4D6C5B442894E95A13E4A699E07D694CF\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D197730AB
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D197730AB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\CEA586B2CE593EC7D939898337C57814708AB2BE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\CEA586B2CE593EC7D939898337C57814708AB2BE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\D018B62DC518907247DF50925BB09ACF4A5CB3AD
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\D018B62DC518907247DF50925BB09ACF4A5CB3AD\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D74DEE97
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D74DEE97\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Disallowed
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root\PhysicalStores
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root\ProtectedRoots
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root\
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\AuthRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\BlobCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\BlobLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\Root
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\ROOT\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\ROOT\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\ROOT\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\ROOT\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\SmartCardRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\SmartCardRoot
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\SmartCardRoot\
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\TrustedPeople
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\TrustedPeople\
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\TrustedPeople
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\TrustedPeople\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\trust\PhysicalStores
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\trust
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\trust\
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\trust\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\trust\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\trust\CTLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\trust
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\trust\Certificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\trust\CRLs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust\PhysicalStores
HKEY_LOCAL_MACHINE\Software\Microsoft\EnterpriseCertificates\trust
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CRLs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Trust\CTLs
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\System\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Policies\Microsoft\SystemCertificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertLastSyncTime
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertEncodedCtl
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllImportPublicKeyInfoEx2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllImportPublicKeyInfoEx2
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllVerifyEncodedSignature
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CryptDllVerifyEncodedSignature
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CertDllVerifyCertificateChainPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 1\CertDllVerifyCertificateChainPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings\{1420C12A-35FB-4FBB-A062-36E2599980B8}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{1420C12A-35FB-4FBB-A062-36E2599980B8}\PersistedPingString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{1420C12A-35FB-4FBB-A062-36E2599980B8}\PersistedPingTime
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastChecked
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\DownloadTimeRemainingMs
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\DownloadProgressPercent
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Environment
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Volatile Environment
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Volatile Environment\0
\xd3d8\xb1EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xd3d8\xb1EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
\xd3d8\xb1EY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerResult
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerResultUIString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerError
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerExtraCode1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerSuccessLaunchCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerResult
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerResultUIString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerError
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerExtraCode1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerSuccessLaunchCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerResult
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerError
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerExtraCode1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerResultUIString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerSuccessLaunchCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\InstallTimeRemainingMs
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\InstallProgressPercent
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Setup\State
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State\ImageState
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2004
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2004
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState\StateValue
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{1420C12A-35FB-4FBB-A062-36E2599980B8}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_CLASSES\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\TreatAs
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\Progid
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\AppID
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_CLASSES\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LoadUserSettings
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\Elevation
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\AppID
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\LocalServer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\Elevation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\ActivationFailureLoggingLevel
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Power\PowerRequestOverride
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Power\PowerRequestOverride\Driver
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\CoInitializeSecurityParam
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\ImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\AuthenticationCapabilities
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\CoInitializeSecurityAppID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\DeferredCoInitializeSecurityServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\DefaultRpcStackSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\SystemCritical
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\svchost.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
\xc800\xb9EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xc710\xb9EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
\xc710\xb9EY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xe800\xb9EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xe710\xb9EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\PendingFileRenameOperations
HKEY_LOCAL_MACHINE\Software\Google\
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientStateMedium\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\path
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\UninstallCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\gupdate_task_name_c
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\gupdate_task_name_ua
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\IsMSIHelperRegistered
HKEY_LOCAL_MACHINE\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppID
HKEY_CLASSES_ROOT\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CurVer\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\VersionIndependentProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\gupdatem_service_name
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CurVer\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CurVer\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CurVer\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Time Zones\Canada Central Standard Time\Dynamic DST
HKEY_LOCAL_MACHINE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\GoogleUpdateTaskMachineCore.job
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\GoogleUpdateTaskMachineCore.job.fp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\GoogleUpdateTaskMachineUA.job
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\GoogleUpdateTaskMachineUA.job.fp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM\RepositoryRestoreInProgress
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\GoogleUpdateComRegisterShell64.exe
HKEY_LOCAL_MACHINE\system\Setup
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\cmd.exe
HKEY_LOCAL_MACHINE\Software
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9AAA1336-C131-4B16-9A86-7BAF3B3B76F8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9AAA1336-C131-4B16-9A86-7BAF3B3B76F8}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9AAA1336-C131-4B16-9A86-7BAF3B3B76F8}\InprocHandler32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9AAA1336-C131-4B16-9A86-7BAF3B3B76F8}\InprocHandler32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_CLASSES_ROOT\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\(Default)
HKEY_CLASSES_ROOT\Interface
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods\(Default)
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
\x8ad0\x22dEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\75.0 (x86 en-GB)\Main\Install Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Thunderbird\60.5.0 (en-US)\Main\Install Directory
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\LanmanWorkstation\Parameters\RpcCacheTimeout
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcSs\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\WOW64
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ProgramData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Public
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18\ProfileImagePath
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VaultSvc\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\WOW64
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gpsvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\WOW64
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\RequiredPrivileges
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Environment
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\DcomLaunch\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioSrv\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AeLookupSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CryptSvc\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BFE\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EventSystem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\AudioEndpointBuilder\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\RpcEptMapper\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\FDResPub\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PolicyAgent\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate\Description
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\ImagePath
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Type
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Start
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\ErrorControl
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Tag
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\DependOnService
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\DependOnGroup
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Group
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\ObjectName
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_USERS\.DEFAULT\Control Panel\International\LocaleName
HKEY_USERS\.DEFAULT\Control Panel\International\sCountry
HKEY_USERS\.DEFAULT\Control Panel\International\sList
HKEY_USERS\.DEFAULT\Control Panel\International\sDecimal
HKEY_USERS\.DEFAULT\Control Panel\International\sThousand
HKEY_USERS\.DEFAULT\Control Panel\International\sGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sNativeDigits
HKEY_USERS\.DEFAULT\Control Panel\International\sCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\sMonDecimalSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonThousandSep
HKEY_USERS\.DEFAULT\Control Panel\International\sMonGrouping
HKEY_USERS\.DEFAULT\Control Panel\International\sPositiveSign
HKEY_USERS\.DEFAULT\Control Panel\International\sNegativeSign
HKEY_USERS\.DEFAULT\Control Panel\International\sTimeFormat
HKEY_USERS\.DEFAULT\Control Panel\International\sShortTime
HKEY_USERS\.DEFAULT\Control Panel\International\s1159
HKEY_USERS\.DEFAULT\Control Panel\International\s2359
HKEY_USERS\.DEFAULT\Control Panel\International\sShortDate
HKEY_USERS\.DEFAULT\Control Panel\International\sYearMonth
HKEY_USERS\.DEFAULT\Control Panel\International\sLongDate
HKEY_USERS\.DEFAULT\Control Panel\International\iCountry
HKEY_USERS\.DEFAULT\Control Panel\International\iMeasure
HKEY_USERS\.DEFAULT\Control Panel\International\iPaperSize
HKEY_USERS\.DEFAULT\Control Panel\International\iDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iLZero
HKEY_USERS\.DEFAULT\Control Panel\International\iNegNumber
HKEY_USERS\.DEFAULT\Control Panel\International\NumShape
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrDigits
HKEY_USERS\.DEFAULT\Control Panel\International\iCurrency
HKEY_USERS\.DEFAULT\Control Panel\International\iNegCurr
HKEY_USERS\.DEFAULT\Control Panel\International\iCalendarType
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstDayOfWeek
HKEY_USERS\.DEFAULT\Control Panel\International\iFirstWeekOfYear
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions\00060101.00060101
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\OemInstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\usagestats
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\gupdate_service_name
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppId
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaxSxSHashCount
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Control Panel\International\LocaleName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}\RegistrationUpdateHook
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\client
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}\name
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\lang
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ap
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\brand
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\client
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\InstallTime
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfInstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\oeminstall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\UBR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}\experiment_labels
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\uid-create-time
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\uid-num-rotations
\xd798\xabEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xd798\xabEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\WpadExpirationDays
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Clients\StartMenuInternet\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xd798\xabEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\proxy\source
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextLockCount
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\SCHANNEL\UserContextListCount
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.44.3.4!7\Name
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\StringCacheSettings\StringCacheGeneration
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_CLASSES\Local Settings\MuiCache\1E4\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.47.1.1!7\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.64.1.1!7\Name
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_CLASSES\Local Settings\MuiCache\1E4\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagLevel
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\crypt32\DiagMatchAnyMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertSyncDeltaTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableMandatoryBasicConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableCANameConstraints
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\DisableUnsupportedCriticalExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlCountInCert
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCountPerChain
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalByteCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MaxAIAUrlRetrievalCertCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\CryptnetPreFetchTriggerPeriodSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\EnableWeakSignatureFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\MinRsaPubKeyBitLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRsaPubKeyTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\ChainCacheResyncFiletime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartyAfterTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakMD5AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMD5AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1ThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1ThirdPartyAfterTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1AllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakSHA1AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1ThirdPartySha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakSHA1AllSha256Allow
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakRSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakRSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakRSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakECDSAThirdPartyFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\WeakECDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakECDSAAllFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1339698970-4093829097-1161395185-1000\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\109F1CAED645BB78B3EA2B94C0697C740733031C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D559A586669B08F46A30A133F8A9ED3D038E2EA8\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs\A377D1B1C0538833035211F4083D00FECC414DAB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\1916A2AF346D399F50313C393200F14140456616\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2A83E9020591A55FC6DDAD3FB102794C52B24E70\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\2B84BFBB34EE2EF949FE1CBE30AA026416EB2216\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\305F8BD17AA2CBC483A4C41B19A39A0C75DA39D6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\367D4B3B4FCBBC0B767B2EC0CDB2A36EAB71A4EB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\3A850044D8A195CD401A680C012CB0A3B5F8DC08\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\40AA38731BD189F9CDB5B9DC35E2136F38777AF4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\43D9BCB568E039D073A74A71D8511F7476089CC3\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\471C949A8143DB5AD5CDF1C972864A2504FA23C9\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\51C3247D60F356C7CA3BAF4C3F429DAC93EE7B74\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\5DE83EE82AC5090AEA9D6AC4E7A6E213F946E179\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\61793FCBFA4F9008309BBA5FF12D2CB29CD4151A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\63FEAE960BAA91E343CE2BD8B71798C76BDB77D0\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\6431723036FD26DEA502792FA595922493030F97\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\7D7F4414CCEF168ADF6BF40753B5BECD78375931\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\80962AE4D6C5B442894E95A13E4A699E07D694CF\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\86E817C81A5CA672FE000F36F878C19518D6F844\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\8E5BD50D6AE686D65252F843A9D4B96D197730AB\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\9845A431D51959CAF225322B4A4FE9F223CE6D15\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B533345D06F64516403C00DA03187D3BFEF59156\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\B86E791620F759F17B8D25E38CA8BE32E7D5EAC2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\C060ED44CBD881BD0EF86C0BA287DDCF8167478C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\CEA586B2CE593EC7D939898337C57814708AB2BE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\D018B62DC518907247DF50925BB09ACF4A5CB3AD\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\F8A54E03AADC5692B850496A4C4630FFEAA29D83\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\FA6660A94AB45F6A88C0D7874D89A863D74DEE97\Blob
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\SystemCertificates\Root\ProtectedRoots\Certificates
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\18F7C1FCC3090203FD5BAA2F861A754976C8DD25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\245C97DF7514E7CF2DF8BE72AE957B9E04741E85\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F88CD7223F3C813818C994614A89C99FA3B5247\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\A43489159A520F0D93D032CCAF37E7FE20A8B419\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\BE36A4562FB2EE05DBB3D32323ADF445084ED656\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\3679CA35668772304D30A5FB873B0FA77BB70D54\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\BlobCount
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4F65566336DB6598581D584A596C87934D5F2AB4\BlobLength
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\627F8D7827656399D27D7F9044C9FEB3F33EFA9A\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\742C3192E607E424EB4549542BE1BBC53E6174E2\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\97817950D81C9670CC34D809CF794431367EF474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserenvDebugLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\GpSvcDebugLevel
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertLastSyncTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\DisallowedCertEncodedCtl
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ProgramFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\CommonFilesDir (x86)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ProgramW6432Dir
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\CommonW6432Dir
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Local AppData
\xd3d8\xb1EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xd3d8\xb1EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
\xd3d8\xb1EY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerResult
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerError
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerExtraCode1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerResultUIString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerSuccessLaunchCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerResult
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerError
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerExtraCode1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerResultUIString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerSuccessLaunchCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\UpdateAvailableSince
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State\ImageState
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2004
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2004
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RunAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ActivateAtStorage
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\ROTFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AppIDFlags
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LaunchPermission
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyAuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\LegacyImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\RemoteServerName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\SRPTrustLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\PreferredServerBitness
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{69AD4AEE-51BE-439B-A92C-86AE490E8B30}\LoadUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4991D34B-80A1-4291-83B6-3328366B9097}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\ActivationFailureLoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\CoInitializeSecurityParam
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\AuthenticationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\ImpersonationLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\AuthenticationCapabilities
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\CoInitializeSecurityAppID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\DeferredCoInitializeSecurityServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\DefaultRpcStackSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs\SystemCritical
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\MaximumAllowedAllocationSize
\xc800\xb9EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xc710\xb9EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
\xc710\xb9EY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\WinHttpSettings
\xe800\xb9EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecision
\xe710\xb9EY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-6f-d4-05\WpadDecisionTime
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\PendingFileRenameOperations
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\gupdate_task_name_c
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPSampledIn
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\gupdate_task_name_ua
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\gupdatem_service_name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoKMS\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\SchedulingEngineKnob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\DynamicInfo
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA\Id
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\Path
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\DynamicInfo
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\BITS\Type
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings\{12BA7A40-B22D-4CDD-A4EC-0E3412BABEA0}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{12BA7A40-B22D-4CDD-A4EC-0E3412BABEA0}\PersistedPingString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{12BA7A40-B22D-4CDD-A4EC-0E3412BABEA0}\PersistedPingTime
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\pv
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\StateValue
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000_CLASSES\Local Settings\MuiCache\1E4\52C64B7E\LanguageList
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE\Blob
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\proxy\source
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\DayOfInstall
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort\hint
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\cohort\name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\UpdateAvailableCount
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\UpdateAvailableSince
HKEY_USERS\S-1-5-21-1339698970-4093829097-1161395185-1000\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ActivePingDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\RollCallDayStartSec
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastActivity
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfLastRollCall
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\ping_freshness
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\DayOfInstall
HKEY_LOCAL_MACHINE\Software\Google\Update\PersistedPings\{1420C12A-35FB-4FBB-A062-36E2599980B8}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{1420C12A-35FB-4FBB-A062-36E2599980B8}\PersistedPingString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\PersistedPings\{1420C12A-35FB-4FBB-A062-36E2599980B8}\PersistedPingTime
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastChecked
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\DownloadTimeRemainingMs
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\DownloadProgressPercent
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\InstallTimeRemainingMs
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState\InstallProgressPercent
HKEY_LOCAL_MACHINE\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState\StateValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\path
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\UninstallCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\pv
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\Clients\{430FD4D0-B729-4F61-AA34-91526481799D}\name
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GoogleUpdate.exe\DisableExceptionChainValidation
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\IsMSIHelperRegistered
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\GoogleUpdate.exe\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService.1.0\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3COMClassService\CurVer\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\VersionIndependentProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4EB61BAC-A3B6-4760-9581-655041EF4D69}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\LocalService
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ServiceParameters
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc.1.0\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.OnDemandCOMClassSvc\CurVer\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\VersionIndependentProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9465B4B4-5216-4042-9A2C-754D3BCDC410}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc.1.0\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.Update3WebSvc\CurVer\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\VersionIndependentProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{534F5323-3569-4F42-919D-1E1CF93E5BF6}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass.1\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CLSID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\GoogleUpdate.CoreClass\CurVer\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\ProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\VersionIndependentProgID\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E225E692-4B47-4777-9BED-4FD7FE257F0E}\AppID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F1CFB55D-77F1-47B5-9A43-21BF6384BCFF}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA\Index
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\Hash
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F417FC0C-A2EF-4C2E-9032-217D1482E5C1}\Triggers
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D6AA569-9F30-41AD-885A-346685C74928}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9AAA1336-C131-4B16-9A86-7BAF3B3B76F8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9AAA1336-C131-4B16-9A86-7BAF3B3B76F8}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9AAA1336-C131-4B16-9A86-7BAF3B3B76F8}\InprocHandler32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9AAA1336-C131-4B16-9A86-7BAF3B3B76F8}\InprocHandler32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\InProcServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9957D25-7EB7-42C8-AD32-06AF7776A788}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2E629606-312A-482F-9B12-2C4ABF6F0B6D}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{19692F10-ADD2-4EFF-BE54-E61C62E40D13}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{31AC3F11-E5EA-4A85-8A3D-8E095A39C27B}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8476CE12-AE1F-4198-805C-BA0F9B783F57}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{0CD01D1E-4A1C-489D-93B9-9B6672877C57}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4E223325-C16B-4EEB-AEDC-19AA99A237FA}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BCDCB538-01C0-46D1-A6A7-52F4D021C272}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{49D7563B-2DDB-4831-88C8-768A53833837}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DAB1D343-1B2A-47F9-B445-93DC50704BFE}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{3D05F64F-71E3-48A5-BF6B-83315BC8AE1F}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6DB17455-4E85-46E7-9D23-E555E4B005AF}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DD42475D-6D46-496A-924E-BD5630B4CBBA}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D106AB5F-A70E-400E-A21B-96208C1D8DBB}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B3A47570-0A85-4AEA-8270-529D47899603}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{18D0F672-18B4-48E6-AD36-6E6BF01DBBC4}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{2D363682-561D-4C3A-81C6-F2F82107562A}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{DCAB8386-4F03-4DBD-A366-D90BC9F68DE6}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{76F7B787-A67C-4C73-82C7-31F5E3AABC5C}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F63F6F8B-ACD5-413C-A44B-0409136D26CB}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{128C2DA6-2BC0-44C0-B3F6-4EC22E647964}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{084D78A8-B084-4E14-A629-A2C419B0E3D9}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{909489C2-85A6-4322-AA56-D25278649D67}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{494B20CF-282E-4BDD-9F5D-B70CB09D351E}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5B25A8DC-1780-4178-A629-6BE8B8DEFAA2}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FE908CDD-22BB-472A-9870-1A0390E42F36}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{1C642CED-CA3B-4013-A9DF-CA6CE5FF6503}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{247954F9-9EDC-4E68-8CC3-150C2B89EADF}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{4DE778FE-F195-4EE3-9DAB-FE446C239221}\NumMethods\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\uid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\old-uid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\InstallerProgress
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\75E0ABB6138512271C04F85FDDDE38E4B7242EFE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\tttoken
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\dr
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\iid
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerResult
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerResultUIString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerError
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerExtraCode1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\LastInstallerSuccessLaunchCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerResult
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerResultUIString
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerError
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerExtraCode1
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\LastInstallerSuccessLaunchCmdLine
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Google\Update\eulaaccepted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\GoogleUpdateTaskMachineCore.job
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\GoogleUpdateTaskMachineCore.job.fp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\GoogleUpdateTaskMachineUA.job
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures\GoogleUpdateTaskMachineUA.job.fp
kernel32.dll.FlsAlloc
kernel32.dll.FlsGetValue
kernel32.dll.FlsSetValue
kernel32.dll.FlsFree
kernelbase.dll.InitializeCriticalSectionAndSpinCount
kernel32.dll.ProcessIdToSessionId
imm32.dll.ImmCreateContext
imm32.dll.ImmDestroyContext
imm32.dll.ImmNotifyIME
imm32.dll.ImmAssociateContext
imm32.dll.ImmReleaseContext
imm32.dll.ImmGetContext
imm32.dll.ImmGetCompositionStringA
imm32.dll.ImmSetCompositionStringA
imm32.dll.ImmGetCompositionStringW
imm32.dll.ImmSetCompositionStringW
imm32.dll.ImmSetCandidateWindow
kernel32.dll.GetDiskFreeSpaceExA
oleaut32.dll.VariantChangeTypeEx
oleaut32.dll.VarNeg
oleaut32.dll.VarNot
oleaut32.dll.VarAdd
oleaut32.dll.VarSub
oleaut32.dll.VarMul
oleaut32.dll.VarDiv
oleaut32.dll.VarIdiv
oleaut32.dll.VarMod
oleaut32.dll.VarAnd
oleaut32.dll.VarOr
oleaut32.dll.VarXor
oleaut32.dll.VarCmp
oleaut32.dll.VarI4FromStr
oleaut32.dll.VarR4FromStr
oleaut32.dll.VarR8FromStr
oleaut32.dll.VarDateFromStr
oleaut32.dll.VarCyFromStr
oleaut32.dll.VarBoolFromStr
oleaut32.dll.VarBstrFromCy
oleaut32.dll.VarBstrFromDate
oleaut32.dll.VarBstrFromBool
user32.dll.GetMonitorInfoA
user32.dll.GetSystemMetrics
user32.dll.EnumDisplayMonitors
user32.dll.AnimateWindow
comctl32.dll.InitializeFlatSB
comctl32.dll.UninitializeFlatSB
comctl32.dll.FlatSB_GetScrollProp
comctl32.dll.FlatSB_SetScrollProp
comctl32.dll.FlatSB_EnableScrollBar
comctl32.dll.FlatSB_ShowScrollBar
comctl32.dll.FlatSB_GetScrollRange
comctl32.dll.FlatSB_GetScrollInfo
comctl32.dll.FlatSB_GetScrollPos
comctl32.dll.FlatSB_SetScrollPos
comctl32.dll.FlatSB_SetScrollInfo
comctl32.dll.FlatSB_SetScrollRange
user32.dll.SetLayeredWindowAttributes
kernel32.dll.FileTimeToSystemTime
cryptsp.dll.CryptAcquireContextW
cryptsp.dll.CryptCreateHash
cryptsp.dll.CryptHashData
cryptsp.dll.CryptGetHashParam
cryptsp.dll.CryptDestroyHash
cryptsp.dll.CryptReleaseContext
nss3.dll.NSS_Init
nss3.dll.NSS_Shutdown
nss3.dll.PK11_GetInternalKeySlot
nss3.dll.PK11_FreeSlot
nss3.dll.PK11_Authenticate
nss3.dll.PK11SDR_Decrypt
nss3.dll.PK11_CheckUserPassword
nss3.dll.SECITEM_FreeItem
kernel32.dll.InitializeCriticalSectionEx
softokn3.dll.NSC_GetFunctionList
softokn3.dll.NSC_ModuleDBFunc
freebl3.dll.FREEBL_GetVector
cryptbase.dll.SystemFunction001
cryptbase.dll.SystemFunction002
cryptbase.dll.SystemFunction003
cryptbase.dll.SystemFunction004
cryptbase.dll.SystemFunction005
cryptbase.dll.SystemFunction028
cryptbase.dll.SystemFunction029
cryptbase.dll.SystemFunction034
cryptbase.dll.SystemFunction036
cryptbase.dll.SystemFunction040
cryptbase.dll.SystemFunction041
vaultcli.dll.VaultEnumerateItems
vaultcli.dll.VaultEnumerateVaults
vaultcli.dll.VaultFree
vaultcli.dll.VaultGetItem
vaultcli.dll.VaultOpenVault
vaultcli.dll.VaultCloseVault
nss3.dll.sqlite3_finalize
nss3.dll.sqlite3_step
nss3.dll.sqlite3_close
nss3.dll.sqlite3_column_text
nss3.dll.sqlite3_open16
nss3.dll.sqlite3_prepare_v2
sechost.dll.LookupAccountSidLocalW
netapi32.dll.NetUserGetInfo
cryptsp.dll.CryptImportKey
cryptsp.dll.CryptSetKeyParam
cryptsp.dll.CryptDecrypt
cryptsp.dll.CryptDestroyKey
kernel32.dll.LCMapStringEx
kernel32.dll.SetDefaultDllDirectories
kernel32.dll.InitOnceExecuteOnce
kernel32.dll.CreateEventExW
kernel32.dll.CreateSemaphoreW
kernel32.dll.CreateSemaphoreExW
kernel32.dll.CreateThreadpoolTimer
kernel32.dll.SetThreadpoolTimer
kernel32.dll.WaitForThreadpoolTimerCallbacks
kernel32.dll.CloseThreadpoolTimer
kernel32.dll.CreateThreadpoolWait
kernel32.dll.SetThreadpoolWait
kernel32.dll.CloseThreadpoolWait
kernel32.dll.FlushProcessWriteBuffers
kernel32.dll.FreeLibraryWhenCallbackReturns
kernel32.dll.GetCurrentProcessorNumber
kernel32.dll.CreateSymbolicLinkW
kernel32.dll.GetTickCount64
kernel32.dll.GetFileInformationByHandleEx
kernel32.dll.SetFileInformationByHandle
kernel32.dll.InitializeConditionVariable
kernel32.dll.WakeConditionVariable
kernel32.dll.WakeAllConditionVariable
kernel32.dll.SleepConditionVariableCS
kernel32.dll.InitializeSRWLock
kernel32.dll.AcquireSRWLockExclusive
kernel32.dll.TryAcquireSRWLockExclusive
kernel32.dll.ReleaseSRWLockExclusive
kernel32.dll.SleepConditionVariableSRW
kernel32.dll.CreateThreadpoolWork
kernel32.dll.SubmitThreadpoolWork
kernel32.dll.CloseThreadpoolWork
kernel32.dll.CompareStringEx
kernel32.dll.GetLocaleInfoEx
kernel32.dll.SortGetHandle
kernel32.dll.SortCloseHandle
goopdate.dll.DllEntry
kernel32.dll.RtlCaptureStackBackTrace
ntmarta.dll.GetMartaExtensionInterface
kernel32.dll.CreateMutexExW
dbghelp.dll.MiniDumpWriteDump
rpcrt4.dll.UuidCreate
sechost.dll.LookupAccountNameLocalW
advapi32.dll.LookupAccountSidW
cryptsp.dll.CryptGenRandom
rpcrtremote.dll.I_RpcExtInitializeExtensionPoint
ole32.dll.CoGetClassObject
ole32.dll.CoGetMarshalSizeMax
ole32.dll.CoMarshalInterface
ole32.dll.CoUnmarshalInterface
ole32.dll.StringFromIID
ole32.dll.CoGetPSClsid
ole32.dll.CoTaskMemAlloc
ole32.dll.CoTaskMemFree
ole32.dll.CoCreateInstance
ole32.dll.CoReleaseMarshalData
ole32.dll.DcomChannelSetHResult
psmachine.dll.DllGetClassObject
psmachine.dll.DllCanUnloadNow
advapi32.dll.RegOpenKeyW
ntdll.dll.RtlGetVersion
kernel32.dll.GetNativeSystemInfo
winhttp.dll.WinHttpAddRequestHeaders
winhttp.dll.WinHttpCheckPlatform
winhttp.dll.WinHttpCloseHandle
winhttp.dll.WinHttpConnect
winhttp.dll.WinHttpCrackUrl
winhttp.dll.WinHttpCreateUrl
winhttp.dll.WinHttpDetectAutoProxyConfigUrl
winhttp.dll.WinHttpGetIEProxyConfigForCurrentUser
winhttp.dll.WinHttpGetDefaultProxyConfiguration
winhttp.dll.WinHttpGetProxyForUrl
winhttp.dll.WinHttpOpen
winhttp.dll.WinHttpOpenRequest
winhttp.dll.WinHttpQueryAuthSchemes
winhttp.dll.WinHttpQueryDataAvailable
winhttp.dll.WinHttpQueryHeaders
winhttp.dll.WinHttpQueryOption
winhttp.dll.WinHttpReadData
winhttp.dll.WinHttpReceiveResponse
winhttp.dll.WinHttpSendRequest
winhttp.dll.WinHttpSetDefaultProxyConfiguration
winhttp.dll.WinHttpSetCredentials
winhttp.dll.WinHttpSetOption
winhttp.dll.WinHttpSetStatusCallback
winhttp.dll.WinHttpSetTimeouts
winhttp.dll.WinHttpWriteData
advapi32.dll.SetThreadToken
ole32.dll.CoInitializeEx
advapi32.dll.RegDeleteTreeA
advapi32.dll.RegDeleteTreeW
nsi.dll.NsiAllocateAndGetTable
cfgmgr32.dll.CM_Open_Class_Key_ExW
iphlpapi.dll.ConvertInterfaceGuidToLuid
iphlpapi.dll.GetIfEntry2
iphlpapi.dll.GetIpForwardTable2
iphlpapi.dll.GetIpNetEntry2
iphlpapi.dll.FreeMibTable
nsi.dll.NsiFreeTable
ole32.dll.CoUninitialize
oleaut32.dll.#500
advapi32.dll.RevertToSelf
shlwapi.dll.StrCmpNW
shlwapi.dll.#153
ws2_32.dll.GetAddrInfoW
ws2_32.dll.WSASocketW
ws2_32.dll.#2
ws2_32.dll.#21
ws2_32.dll.#9
ws2_32.dll.WSAIoctl
ws2_32.dll.#6
ws2_32.dll.#5
schannel.dll.SpUserModeInitialize
advapi32.dll.RegCreateKeyExW
advapi32.dll.RegQueryValueExW
advapi32.dll.RegCloseKey
ws2_32.dll.FreeAddrInfoW
ws2_32.dll.WSASend
ws2_32.dll.WSARecv
secur32.dll.FreeContextBuffer
ncrypt.dll.SslOpenProvider
ncrypt.dll.GetSChannelInterface
bcryptprimitives.dll.GetHashInterface
ncrypt.dll.SslIncrementProviderReferenceCount
ncrypt.dll.SslImportKey
bcryptprimitives.dll.GetCipherInterface
ncrypt.dll.SslLookupCipherSuiteInfo
ncrypt.dll.SslLookupCipherLengths
user32.dll.LoadStringW
ncrypt.dll.BCryptOpenAlgorithmProvider
ncrypt.dll.BCryptGetProperty
ncrypt.dll.BCryptCreateHash
ncrypt.dll.BCryptHashData
ncrypt.dll.BCryptFinishHash
ncrypt.dll.BCryptDestroyHash
crypt32.dll.CertGetCertificateChain
userenv.dll.GetUserProfileDirectoryW
sechost.dll.ConvertSidToStringSidW
sechost.dll.ConvertStringSidToSidW
userenv.dll.RegisterGPNotification
gpapi.dll.RegisterGPNotificationInternal
sechost.dll.OpenSCManagerW
sechost.dll.OpenServiceW
sechost.dll.CloseServiceHandle
sechost.dll.QueryServiceConfigW
cryptsp.dll.CryptAcquireContextA
winsta.dll.WinStationRegisterNotificationEvent
advapi32.dll.CreateWellKnownSid
rpcrt4.dll.RpcStringBindingComposeW
rpcrt4.dll.RpcBindingFromStringBindingW
rpcrt4.dll.RpcStringFreeW
rpcrt4.dll.RpcBindingSetAuthInfoExW
rpcrt4.dll.RpcAsyncInitializeHandle
rpcrt4.dll.NdrClientCall2
rpcrt4.dll.NdrAsyncClientCall
bcryptprimitives.dll.GetSignatureInterface
ncrypt.dll.BCryptImportKeyPair
ncrypt.dll.BCryptDestroyKey
cryptsp.dll.CryptGetKeyParam
cryptsp.dll.CryptVerifySignatureA
bcryptprimitives.dll.GetAsymmetricEncryptionInterface
ncrypt.dll.BCryptVerifySignature
crypt32.dll.CertVerifyCertificateChainPolicy
crypt32.dll.CertFreeCertificateChain
crypt32.dll.CertDuplicateCertificateContext
ncrypt.dll.SslEncryptPacket
ncrypt.dll.SslDecryptPacket
winsta.dll.WinStationEnumerateW
rpcrt4.dll.I_RpcExceptionFilter
rpcrt4.dll.RpcBindingFree
winsta.dll.WinStationFreeMemory
winsta.dll.WinStationQueryInformationW
sspicli.dll.GetUserNameExW
kernel32.dll.WTSGetActiveConsoleSessionId
kernel32.dll.IsWow64Process
psapi.dll.GetProcessImageFileNameW
crypt32.dll.CertFreeCertificateContext
comctl32.dll.RegisterClassNameW
uxtheme.dll.EnableThemeDialogTexture
setupapi.dll.CM_Get_Device_Interface_List_Size_ExW
setupapi.dll.CM_Get_Device_Interface_List_ExW
comctl32.dll.#386
kernel32.dll.GetProcessId
api-ms-win-downlevel-advapi32-l1-1-0.dll.UnregisterTraceGuids
advapi32.dll.UnregisterTraceGuids
ncrypt.dll.SslFreeObject
comctl32.dll.#321
ole32.dll.CoInitializeSecurity
ntdll.dll.NtQueryInformationProcess
advapi32.dll.RegDeleteKeyExW
psmachine.dll.DllRegisterServer
psmachine_64.dll.DllRegisterServer
ole32.dll.NdrOleInitializeExtension
"C:\Users\Louise\AppData\Local\Temp\q2w0yYbvMGBN.exe"
C:\Windows\system32\lsass.exe
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc
C:\Windows\System32\svchost.exe -k netsvcs
"C:\Program Files (x86)\Google\Update\Install\{26FAD9E2-9546-4920-A06C-6EBFB87AF4DF}\GoogleUpdateSetup.exe" /update /sessionid "{FA04A27E-D95E-4D44-80EB-05C8E924CC34}"
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNS40NTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNS40NTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkEwNEEyN0UtRDk1RS00RDQ0LTgwRUItMDVDOEU5MjRDQzM0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxNDIwQzEyQS0zNUZCLTRGQkItQTA2Mi0zNkUyNTk5OTgwQjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIwIiBzc2U0Mj0iMCIgYXZ4PSIwIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNS40NTEiIG5leHR2ZXJzaW9uPSIxLjMuMzUuNDUyIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjIiIGlpZD0ie0EwMjVGQzM5LURDODEtQjMwQy04NzlCLTNBODU4MkJFNzVBQn0iIGNvaG9ydD0iMTo5Y286IiBjb2hvcnRuYW1lPSJFdmVyeW9uZSBFbHNlIj48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL3JlZGlyZWN0b3IuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL3VwZGF0ZTIvQU9WZTk4YTNmaTNvSUE1Q2ZUbDNpYmNfMS4zLjM1LjQ1Mi9Hb29nbGVVcGRhdGVTZXR1cC5leGUiIGRvd25sb2FkZWQ9IjEyOTU1NzYiIHRvdGFsPSIxMjk1NTc2IiBkb3dubG9hZF90aW1lX21zPSI0MjUyOSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iODEuMC40MDQ0LjExMyIgbmV4dHZlcnNpb249IiIgYXA9InN0YWJsZS1hcmNoX3g4Ni1zdGF0c2RlZl8wIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjIiIGlpZD0ie0EwMjVGQzM5LURDODEtQjMwQy04NzlCLTNBODU4MkJFNzVBQn0iPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSI5IiBlcnJvcmNvZGU9Ii0xNjA2MjE5NzQ4IiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
C:\Program Files (x86)\Google\Update\GoogleUpdate.exe /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNS40NTEiIHNoZWxsX3ZlcnNpb249IjEuMy4zNS40NTEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkEwNEEyN0UtRDk1RS00RDQ0LTgwRUItMDVDOEU5MjRDQzM0fSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InsxNDIwQzEyQS0zNUZCLTRGQkItQTA2Mi0zNkUyNTk5OTgwQjh9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIwIiBzc2U0Mj0iMCIgYXZ4PSIwIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMS43NjAxLjAiIHNwPSJTZXJ2aWNlIFBhY2sgMSIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezQzMEZENEQwLUI3MjktNEY2MS1BQTM0LTkxNTI2NDgxNzk5RH0iIHZlcnNpb249IjEuMy4zNS40NTEiIG5leHR2ZXJzaW9uPSIxLjMuMzUuNDUyIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjIiIGlpZD0ie0EwMjVGQzM5LURDODEtQjMwQy04NzlCLTNBODU4MkJFNzVBQn0iIGNvaG9ydD0iMTo5Y286IiBjb2hvcnRuYW1lPSJFdmVyeW9uZSBFbHNlIj48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL3JlZGlyZWN0b3IuZ3Z0MS5jb20vZWRnZWRsL3JlbGVhc2UyL3VwZGF0ZTIvQU9WZTk4YTNmaTNvSUE1Q2ZUbDNpYmNfMS4zLjM1LjQ1Mi9Hb29nbGVVcGRhdGVTZXR1cC5leGUiIGRvd25sb2FkZWQ9IjEyOTU1NzYiIHRvdGFsPSIxMjk1NTc2IiBkb3dubG9hZF90aW1lX21zPSI0MjUyOSIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNDLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iODEuMC40MDQ0LjExMyIgbmV4dHZlcnNpb249IiIgYXA9InN0YWJsZS1hcmNoX3g4Ni1zdGF0c2RlZl8wIiBsYW5nPSIiIGJyYW5kPSJHQ0VCIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iNjIiIGlpZD0ie0EwMjVGQzM5LURDODEtQjMwQy04NzlCLTNBODU4MkJFNzVBQn0iPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSI5IiBlcnJvcmNvZGU9Ii0xNjA2MjE5NzQ4IiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
"C:\Program Files (x86)\Google\Temp\GUMC7E4.tmp\GoogleUpdate.exe" /update /sessionid "{FA04A27E-D95E-4D44-80EB-05C8E924CC34}"
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regsvc
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /regserver
"C:\Program Files (x86)\Google\Update\1.3.35.452\GoogleUpdateComRegisterShell64.exe"
300134BE5A3EACE282B993B6
Global\G{D19BAF17-7C87-467E-8D63-6C4B1C836373}
Global\G{6885AE8E-C070-458d-9711-37B9BEAB65F6}
Global\G{66CC0160-ABB3-4066-AE47-1CA6AD5065C8}
Global\G{0A175FBE-AEEC-4fea-855A-2AA549A88846}
Global\G{A9A86B93-B54E-4570-BE89-42418507707B}
VaultSvc
BITS

PE Information

Image Base Entry Point Reported Checksum Actual Checksum Minimum OS Version Compile Time Import Hash Icon Icon Exact Hash Icon Similarity Hash
0x00400000 0x0046282c 0x00000000 0x000a9227 4.0 1992-06-19 22:22:17 a3bfafd3839d7a926bcc393a99921236 b196788ae84ca5d7e6327df18fc58a89 0ab954406964a00a463561e23b1fff82

Sections

Name RAW Address Virtual Address Virtual Size Size of Raw Data Characteristics Entropy
CODE 0x00000400 0x00001000 0x00061874 0x00061a00 IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 6.52
DATA 0x00061e00 0x00063000 0x0000ae28 0x0000b000 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5.02
BSS 0x0006ce00 0x0006e000 0x00000bf9 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.idata 0x0006ce00 0x0006f000 0x000022b0 0x00002400 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4.95
.tls 0x0006f200 0x00072000 0x00000010 0x00000000 IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0.00
.rdata 0x0006f200 0x00073000 0x00000018 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 0.20
.reloc 0x0006f400 0x00074000 0x00007188 0x00007200 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 6.65
.rsrc 0x00076600 0x0007c000 0x00028780 0x00028800 IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 7.03

Resources

Name Offset Size Language Sub-language Entropy File type
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_CURSOR 0x0009dd98 0x000001dc LANG_ENGLISH SUBLANG_ENGLISH_US 0.00 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_BITMAP 0x0009f1a8 0x000000e8 LANG_NEUTRAL SUBLANG_NEUTRAL 2.85 None
RT_ICON 0x0009f290 0x000025a8 LANG_ENGLISH SUBLANG_ENGLISH_US 2.75 None
RT_DIALOG 0x000a1838 0x00000052 LANG_NEUTRAL SUBLANG_NEUTRAL 2.56 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_STRING 0x000a3d94 0x000002b4 LANG_NEUTRAL SUBLANG_NEUTRAL 3.19 None
RT_RCDATA 0x000a45ec 0x000000f1 LANG_ENGLISH SUBLANG_ENGLISH_US 7.21 None
RT_RCDATA 0x000a45ec 0x000000f1 LANG_ENGLISH SUBLANG_ENGLISH_US 7.21 None
RT_RCDATA 0x000a45ec 0x000000f1 LANG_ENGLISH SUBLANG_ENGLISH_US 7.21 None
RT_RCDATA 0x000a45ec 0x000000f1 LANG_ENGLISH SUBLANG_ENGLISH_US 7.21 None
RT_GROUP_CURSOR 0x000a4758 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x000a4758 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x000a4758 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x000a4758 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x000a4758 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x000a4758 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_CURSOR 0x000a4758 0x00000014 LANG_NEUTRAL SUBLANG_NEUTRAL 2.02 None
RT_GROUP_ICON 0x000a476c 0x00000014 LANG_ENGLISH SUBLANG_ENGLISH_US 2.02 None

Imports

0x46f13c VirtualFree
0x46f140 VirtualAlloc
0x46f144 LocalFree
0x46f148 LocalAlloc
0x46f14c GetVersion
0x46f150 GetCurrentThreadId
0x46f15c VirtualQuery
0x46f160 WideCharToMultiByte
0x46f164 MultiByteToWideChar
0x46f168 lstrlenA
0x46f16c lstrcpynA
0x46f170 LoadLibraryExA
0x46f174 GetThreadLocale
0x46f178 GetStartupInfoA
0x46f17c GetProcAddress
0x46f180 GetModuleHandleA
0x46f184 GetModuleFileNameA
0x46f188 GetLocaleInfoA
0x46f18c GetCommandLineA
0x46f190 FreeLibrary
0x46f194 FindFirstFileA
0x46f198 FindClose
0x46f19c ExitProcess
0x46f1a0 WriteFile
0x46f1a8 RtlUnwind
0x46f1ac RaiseException
0x46f1b0 GetStdHandle
0x46f1b8 GetKeyboardType
0x46f1bc LoadStringA
0x46f1c0 MessageBoxA
0x46f1c4 CharNextA
0x46f1cc RegQueryValueExA
0x46f1d0 RegOpenKeyExA
0x46f1d4 RegCloseKey
0x46f1dc SysFreeString
0x46f1e0 SysReAllocStringLen
0x46f1e4 SysAllocStringLen
0x46f1ec TlsSetValue
0x46f1f0 TlsGetValue
0x46f1f4 LocalAlloc
0x46f1f8 GetModuleHandleA
0x46f200 RegQueryValueExA
0x46f204 RegOpenKeyExA
0x46f208 RegCloseKey
0x46f210 lstrcpyA
0x46f214 WriteFile
0x46f21c WaitForSingleObject
0x46f220 VirtualQuery
0x46f224 VirtualAlloc
0x46f228 Sleep
0x46f22c SizeofResource
0x46f230 SetThreadLocale
0x46f234 SetFilePointer
0x46f238 SetEvent
0x46f23c SetErrorMode
0x46f240 SetEndOfFile
0x46f244 ResetEvent
0x46f248 ReadFile
0x46f24c MulDiv
0x46f250 LockResource
0x46f254 LoadResource
0x46f258 LoadLibraryA
0x46f264 GlobalUnlock
0x46f268 GlobalReAlloc
0x46f26c GlobalHandle
0x46f270 GlobalLock
0x46f274 GlobalFree
0x46f278 GlobalFindAtomA
0x46f27c GlobalDeleteAtom
0x46f280 GlobalAlloc
0x46f284 GlobalAddAtomA
0x46f288 GetVersionExA
0x46f28c GetVersion
0x46f290 GetTickCount
0x46f294 GetThreadLocale
0x46f29c GetSystemTime
0x46f2a0 GetSystemInfo
0x46f2a4 GetStringTypeExA
0x46f2a8 GetStdHandle
0x46f2ac GetProcAddress
0x46f2b0 GetModuleHandleA
0x46f2b4 GetModuleFileNameA
0x46f2b8 GetLocaleInfoA
0x46f2bc GetLocalTime
0x46f2c0 GetLastError
0x46f2c4 GetFullPathNameA
0x46f2c8 GetFileAttributesA
0x46f2cc GetDiskFreeSpaceA
0x46f2d0 GetDateFormatA
0x46f2d4 GetCurrentThreadId
0x46f2d8 GetCurrentProcessId
0x46f2dc GetCPInfo
0x46f2e0 GetACP
0x46f2e4 FreeResource
0x46f2e8 InterlockedExchange
0x46f2ec FreeLibrary
0x46f2f0 FormatMessageA
0x46f2f4 FindResourceA
0x46f2f8 FindFirstFileA
0x46f2fc FindClose
0x46f308 ExitThread
0x46f30c EnumCalendarInfoA
0x46f318 CreateThread
0x46f31c CreateFileA
0x46f320 CreateEventA
0x46f324 CompareStringA
0x46f328 CloseHandle
0x46f330 VerQueryValueA
0x46f338 GetFileVersionInfoA
0x46f340 UnrealizeObject
0x46f344 StretchBlt
0x46f348 SetWindowOrgEx
0x46f34c SetWinMetaFileBits
0x46f350 SetViewportOrgEx
0x46f354 SetTextColor
0x46f358 SetStretchBltMode
0x46f35c SetROP2
0x46f360 SetPixel
0x46f364 SetEnhMetaFileBits
0x46f368 SetDIBColorTable
0x46f36c SetBrushOrgEx
0x46f370 SetBkMode
0x46f374 SetBkColor
0x46f378 SelectPalette
0x46f37c SelectObject
0x46f380 SelectClipRgn
0x46f384 SaveDC
0x46f388 RestoreDC
0x46f38c Rectangle
0x46f390 RectVisible
0x46f394 RealizePalette
0x46f398 Polyline
0x46f39c PlayEnhMetaFile
0x46f3a0 PathToRegion
0x46f3a4 PatBlt
0x46f3a8 MoveToEx
0x46f3ac MaskBlt
0x46f3b0 LineTo
0x46f3b4 IntersectClipRect
0x46f3b8 GetWindowOrgEx
0x46f3bc GetWinMetaFileBits
0x46f3c0 GetTextMetricsA
0x46f3cc GetStockObject
0x46f3d0 GetPixel
0x46f3d4 GetPaletteEntries
0x46f3d8 GetObjectA
0x46f3e4 GetEnhMetaFileBits
0x46f3e8 GetDeviceCaps
0x46f3ec GetDIBits
0x46f3f0 GetDIBColorTable
0x46f3f4 GetDCOrgEx
0x46f3fc GetClipRgn
0x46f400 GetClipBox
0x46f404 GetBrushOrgEx
0x46f408 GetBitmapBits
0x46f40c ExcludeClipRect
0x46f410 DeleteObject
0x46f414 DeleteEnhMetaFile
0x46f418 DeleteDC
0x46f41c CreateSolidBrush
0x46f420 CreateRectRgn
0x46f424 CreatePenIndirect
0x46f428 CreatePalette
0x46f430 CreateFontIndirectA
0x46f434 CreateDIBitmap
0x46f438 CreateDIBSection
0x46f43c CreateCompatibleDC
0x46f444 CreateBrushIndirect
0x46f448 CreateBitmap
0x46f44c CopyEnhMetaFileA
0x46f450 BitBlt
0x46f458 CreateWindowExA
0x46f45c WindowFromPoint
0x46f460 WinHelpA
0x46f464 WaitMessage
0x46f468 UpdateWindow
0x46f46c UnregisterClassA
0x46f470 UnhookWindowsHookEx
0x46f474 TranslateMessage
0x46f47c TrackPopupMenu
0x46f484 ShowWindow
0x46f488 ShowScrollBar
0x46f48c ShowOwnedPopups
0x46f490 ShowCursor
0x46f494 SetWindowsHookExA
0x46f498 SetWindowPos
0x46f49c SetWindowPlacement
0x46f4a0 SetWindowLongA
0x46f4a4 SetTimer
0x46f4a8 SetScrollRange
0x46f4ac SetScrollPos
0x46f4b0 SetScrollInfo
0x46f4b4 SetRect
0x46f4b8 SetPropA
0x46f4bc SetParent
0x46f4c0 SetMenuItemInfoA
0x46f4c4 SetMenu
0x46f4c8 SetForegroundWindow
0x46f4cc SetFocus
0x46f4d0 SetCursor
0x46f4d4 SetClassLongA
0x46f4d8 SetCapture
0x46f4dc SetActiveWindow
0x46f4e0 SendMessageA
0x46f4e4 ScrollWindow
0x46f4e8 ScreenToClient
0x46f4ec RemovePropA
0x46f4f0 RemoveMenu
0x46f4f4 ReleaseDC
0x46f4f8 ReleaseCapture
0x46f504 RegisterClassA
0x46f508 RedrawWindow
0x46f50c PtInRect
0x46f510 PostQuitMessage
0x46f514 PostMessageA
0x46f518 PeekMessageA
0x46f51c OffsetRect
0x46f520 OemToCharA
0x46f524 MessageBoxA
0x46f528 MapWindowPoints
0x46f52c MapVirtualKeyA
0x46f530 LockWindowUpdate
0x46f534 LoadStringA
0x46f538 LoadKeyboardLayoutA
0x46f53c LoadIconA
0x46f540 LoadCursorA
0x46f544 LoadBitmapA
0x46f548 KillTimer
0x46f54c IsZoomed
0x46f550 IsWindowVisible
0x46f554 IsWindowEnabled
0x46f558 IsWindow
0x46f55c IsRectEmpty
0x46f560 IsIconic
0x46f564 IsDialogMessageA
0x46f568 IsChild
0x46f56c InvalidateRect
0x46f570 IntersectRect
0x46f574 InsertMenuItemA
0x46f578 InsertMenuA
0x46f57c InflateRect
0x46f584 GetWindowTextA
0x46f588 GetWindowRect
0x46f58c GetWindowPlacement
0x46f590 GetWindowLongA
0x46f594 GetWindowDC
0x46f598 GetTopWindow
0x46f59c GetSystemMetrics
0x46f5a0 GetSystemMenu
0x46f5a4 GetSysColorBrush
0x46f5a8 GetSysColor
0x46f5ac GetSubMenu
0x46f5b0 GetScrollRange
0x46f5b4 GetScrollPos
0x46f5b8 GetScrollInfo
0x46f5bc GetPropA
0x46f5c0 GetParent
0x46f5c4 GetWindow
0x46f5c8 GetMessagePos
0x46f5cc GetMenuStringA
0x46f5d0 GetMenuState
0x46f5d4 GetMenuItemInfoA
0x46f5d8 GetMenuItemID
0x46f5dc GetMenuItemCount
0x46f5e0 GetMenu
0x46f5e4 GetLastActivePopup
0x46f5e8 GetKeyboardState
0x46f5f0 GetKeyboardLayout
0x46f5f4 GetKeyState
0x46f5f8 GetKeyNameTextA
0x46f5fc GetIconInfo
0x46f600 GetForegroundWindow
0x46f604 GetFocus
0x46f608 GetDlgItem
0x46f60c GetDesktopWindow
0x46f610 GetDCEx
0x46f614 GetDC
0x46f618 GetCursorPos
0x46f61c GetCursor
0x46f620 GetClipboardData
0x46f624 GetClientRect
0x46f628 GetClassNameA
0x46f62c GetClassInfoA
0x46f630 GetCapture
0x46f634 GetActiveWindow
0x46f638 FrameRect
0x46f63c FindWindowA
0x46f640 FillRect
0x46f644 EqualRect
0x46f648 EnumWindows
0x46f64c EnumThreadWindows
0x46f650 EndPaint
0x46f654 EndDeferWindowPos
0x46f658 EnableWindow
0x46f65c EnableScrollBar
0x46f660 EnableMenuItem
0x46f664 DrawTextA
0x46f668 DrawMenuBar
0x46f66c DrawIconEx
0x46f670 DrawIcon
0x46f674 DrawFrameControl
0x46f678 DrawFocusRect
0x46f67c DrawEdge
0x46f680 DispatchMessageA
0x46f684 DestroyWindow
0x46f688 DestroyMenu
0x46f68c DestroyIcon
0x46f690 DestroyCursor
0x46f694 DeleteMenu
0x46f698 DeferWindowPos
0x46f69c DefWindowProcA
0x46f6a0 DefMDIChildProcA
0x46f6a4 DefFrameProcA
0x46f6a8 CreatePopupMenu
0x46f6ac CreateMenu
0x46f6b0 CreateIcon
0x46f6b4 ClientToScreen
0x46f6b8 CheckMenuItem
0x46f6bc CallWindowProcA
0x46f6c0 CallNextHookEx
0x46f6c4 BeginPaint
0x46f6c8 BeginDeferWindowPos
0x46f6cc CharNextA
0x46f6d0 CharLowerBuffA
0x46f6d4 CharLowerA
0x46f6d8 CharToOemA
0x46f6dc AdjustWindowRectEx
0x46f6e8 Sleep
0x46f6f0 SafeArrayPtrOfIndex
0x46f6f4 SafeArrayGetUBound
0x46f6f8 SafeArrayGetLBound
0x46f6fc SafeArrayCreate
0x46f700 VariantChangeType
0x46f704 VariantCopy
0x46f708 VariantClear
0x46f70c VariantInit
0x46f71c ImageList_Write
0x46f720 ImageList_Read
0x46f730 ImageList_DragMove
0x46f734 ImageList_DragLeave
0x46f738 ImageList_DragEnter
0x46f73c ImageList_EndDrag
0x46f740 ImageList_BeginDrag
0x46f744 ImageList_Remove
0x46f748 ImageList_DrawEx
0x46f74c ImageList_Replace
0x46f750 ImageList_Draw
0x46f760 ImageList_Add
0x46f768 ImageList_Destroy
0x46f76c ImageList_Create
0x46f770 InitCommonControls
0x46f778 GetSaveFileNameA
0x46f77c GetOpenFileNameA

This program must be run under Win32
`DATA
.idata
.rdata
P.reloc
P.rsrc
Boolean
False
Integer
Cardinal
String
TObject
TObject
System
IInterface
System
TInterfacedObject
SVWUQ
Z]_^[
YZ]_^[
w;;t$
SVWUQ
Z]_^[
YZ]_^[
Uhd"@
_^[YY]
_^[Y]
YZ]_^[
_^[Y]
C<"u1S
Q<"u8S
,$YXZ
~KxI[)
BkU'9
SOFTWARE\Borland\Delphi\RTL
FPUMaskValue
_^[YY]
PPRTj
YZXtp
YZXtm1
ZTUWVSPRTj
t=HtN
Ph~;@
Uhf<@
t-Rf;
t f;J
SVWRP
Z_^[X
tVSVWU
t1SVW
t-Rf;
t f;J
kernel32.dll
GetLongPathNameA
Software\Borland\Locales
Software\Borland\Delphi\Locales
_^[YY]
FFF;M
^[YY]
odSelected
odGrayed
odDisabled
odChecked
odFocused
odDefault
odHotLight
odInactive
odNoAccel
odNoFocusRect
odReserved1
odReserved2
odComboBoxEdit
Windows
TOwnerDrawState
_^[Y]
_^[Y]
_^[Y]
Magellan MSWHEEL
MouseZ
MSWHEEL_ROLLMSG
MSH_WHEELSUPPORT_MSG
MSH_SCROLL_LINES_MSG
TFileName
Exception
EHeapException
EOutOfMemory
EInOutError
EExternal
EExternalException
EIntError
EDivByZero
ERangeError
EIntOverflow
EMathError
EInvalidOp
EZeroDivide
EOverflow
EUnderflow
EInvalidPointer
EInvalidCast
EConvertError
EAccessViolation
EPrivilege
EStackOverflow
EControlC
EVariantError
EAssertionFailed
EAbstractError
EIntfCastError
EOSError
ESafecallException
SysUtils
SysUtils
TThreadLocalCounter
$TMultiReadExclusiveWriteSynchronizer
SWSVj
False
_^[Y]
TStrData
^[YY]
$Z_^[
$Z_^[
^[YY]
<*t"<0r=<9w9i
INFNAN
QS<$t
_^[YY]
t%HtIHtm
AM/PM
_^[YY]
SVWUQ
$Z]_^[
_^[Y]
QQQQQQSVW3
QQQQQSVW
D$PPj
D$LPj
_^[Y]
_^[YY]
TErrorRec
TExceptRec
t<HtH
$YZ^[
$YZ^[
WUWSj
YZ]_^[
_^[Y]
m/d/yy
mmmm d, yyyy
AMPM
AMPM
:mm:ss
kernel32.dll
GetDiskFreeSpaceExA
SVWUQ
(Z]_^[
SVWUQ
;w$t|
Z]_^[
;F$t=
;C$t4
_^[Y]
oleaut32.dll
VariantChangeTypeEx
VarNeg
VarNot
VarAdd
VarSub
VarMul
VarDiv
VarIdiv
VarMod
VarAnd
VarOr
VarXor
VarCmp
VarI4FromStr
VarR4FromStr
VarR8FromStr
VarDateFromStr
VarCyFromStr
VarBoolFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromBool
TCustomVariantType
TCustomVariantType
Variants
EVariantInvalidOpError
EVariantTypeCastError
EVariantOverflowError
EVariantInvalidArgError`
EVariantBadVarTypeError
EVariantBadIndexError
EVariantArrayLockedError
EVariantArrayCreateError
EVariantNotImplError
EVariantOutOfMemoryError
EVariantUnexpectedError(
EVariantDispatchError
t?Htb
QQQQSV
Empty
Smallint
Integer
Single
Double
Currency
OleStr
Dispatch
Error
Boolean
Variant
Unknown
Decimal
ShortInt
LongWord
Int64
String
Array
ByRef
Variants
_^[YY]
_^[Y]
SVWUQ
Z]_^[
_^[Y]
False
_^[Y]
_^[YY]
$YZ^[
TAlignment
taLeftJustify
taRightJustify
taCenter
Classes
TLeftRight
Classes
TBiDiMode
bdLeftToRight
bdRightToLeft
bdRightToLeftNoAlign
bdRightToLeftReadingOnly
Classes
ssShift
ssAlt
ssCtrl
ssLeft
ssRight
ssMiddle
ssDouble
Classes
TShiftState
THelpContext
THelpType
htKeyword
htContext
Classes
TShortCut
TNotifyEvent
Sender
TObject
EStreamError
EFileStreamError
EFCreateError
EFOpenError
EFilerErrorD
EReadError
EWriteError
EClassNotFound
EResNotFound
EListError
EBitsError
EStringListError
EComponentError
EOutOfResourcest
EInvalidOperation
TList
TThreadList
TBits
TPersistent
TPersistent
Classes
TInterfacedPersistent
TInterfacedPersistent
Classes
TCollectionItem
TCollectionItem
Classes
TCollection
Classes
IStringsAdapter
Classes
TStrings
TStringsL
Classes
TStringItem
TStringList$
TStringList|
Classes
TStream
THandleStream
TFileStream
TCustomMemoryStreaml!A
TMemoryStream
TResourceStream
TStreamAdapter
TClassFinder
TFiler
TReader
EThreadX%A
TComponentNamel%A
IDesignerNotify
Classes
TComponent
TComponent
Classes
Name<
TBasicActionLink
TBasicAction
TBasicActiont(A
Classes
TIdentMapEntry
TRegGroup
TRegGroups
YZ]_^[
_^[Y]
_^[Y]
SVWUQ
u%CNu
Z]_^[
SVWUQ
$Z]_^[
Uh3-A
SVWUQ
Z]_^[
SVWUQ
Z]_^[
SVWUQ
Z]_^[
UhC0A
SVWUQ
$Z]_^[
Uh+3A
_^[YY]
Uh|4A
Uha5A
UhK6A
TIntConst
_^[Y]
_^[Y]
_^[YY]
_^[Y]
Uh*;A
;5H&A
UhP=A
Uh4AA
SVWUQ
Z]_^[
UhZDA
PhtFA
_^[Y]
UhIHA
%s[%d]
_^[Y]
W<CNu
UhtOA
PhdZA
Strings
_^[Y]
UhpRA
UhNRA
UhWUA
S$_^[Y]
^[YY]
UhmWA
UhPWA
_^[YY]
SVWUQ
SdZ]_^[
UhXXA
Uh3XA
UhTZA
Uh7ZA
SVWUQ
$Z]_^[
^[YY]
Uh\eA
_^[Y]
TPropFixup