CAPE

Detections: AgentTesla


Analysis

Category Package Started Completed Duration Options Log
FILE Extraction 2020-01-14 13:35:34 2020-01-14 13:40:21 287 seconds Show Options Show Log
  • Info: The analysis hit the critical timeout, terminating.
route = internet
procdump = 0
2020-01-14 13:35:37,000 [root] INFO: Date set to: 01-14-20, time set to: 13:35:37, timeout set to: 200
2020-01-14 13:35:37,015 [root] DEBUG: Starting analyzer from: C:\mmwcpkjad
2020-01-14 13:35:37,015 [root] DEBUG: Storing results at: C:\xObftrX
2020-01-14 13:35:37,015 [root] DEBUG: Pipe server name: \\.\PIPE\xLiarHoueR
2020-01-14 13:35:37,015 [root] INFO: Analysis package "Extraction" has been specified.
2020-01-14 13:35:37,326 [root] DEBUG: Started auxiliary module Browser
2020-01-14 13:35:37,342 [root] DEBUG: Started auxiliary module Curtain
2020-01-14 13:35:37,342 [modules.auxiliary.digisig] DEBUG: Checking for a digitial signature.
2020-01-14 13:35:37,624 [modules.auxiliary.digisig] DEBUG: File is not signed.
2020-01-14 13:35:37,624 [modules.auxiliary.digisig] INFO: Uploading signature results to aux/DigiSig.json
2020-01-14 13:35:37,624 [root] DEBUG: Started auxiliary module DigiSig
2020-01-14 13:35:37,624 [root] DEBUG: Started auxiliary module Disguise
2020-01-14 13:35:37,624 [root] DEBUG: Started auxiliary module Human
2020-01-14 13:35:37,624 [root] DEBUG: Started auxiliary module Screenshots
2020-01-14 13:35:37,624 [root] DEBUG: Started auxiliary module Sysmon
2020-01-14 13:35:37,638 [root] DEBUG: Started auxiliary module Usage
2020-01-14 13:35:37,638 [root] INFO: Analyzer: DLL set to Extraction.dll from package modules.packages.Extraction
2020-01-14 13:35:37,638 [root] INFO: Analyzer: DLL_64 set to Extraction_x64.dll from package modules.packages.Extraction
2020-01-14 13:35:37,654 [lib.api.process] INFO: Successfully executed process from path "C:\Users\user\AppData\Local\Temp\T_C_FOR_.EXE" with arguments "" with pid 2124
2020-01-14 13:35:37,654 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:37,654 [lib.api.process] INFO: 32-bit DLL to inject is C:\mmwcpkjad\dll\XrozDnA.dll, loader C:\mmwcpkjad\bin\JiNnMnG.exe
2020-01-14 13:35:37,670 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:37,670 [root] DEBUG: Loader: Injecting process 2124 (thread 2372) with C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:37,670 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:37,670 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:37,670 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-01-14 13:35:37,670 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:37,670 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2124
2020-01-14 13:35:39,683 [lib.api.process] INFO: Successfully resumed process with pid 2124
2020-01-14 13:35:39,683 [root] INFO: Added new process to list with pid: 2124
2020-01-14 13:35:39,730 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:35:39,730 [root] DEBUG: Process dumps disabled.
2020-01-14 13:35:39,760 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:39,760 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:39,760 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-01-14 13:35:39,760 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:39,760 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:39,776 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77940000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7799124a, Wow64PrepareForException: 0x0
2020-01-14 13:35:39,776 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x4e0000
2020-01-14 13:35:39,776 [root] DEBUG: Debugger initialised.
2020-01-14 13:35:39,776 [root] DEBUG: CAPE initialised: 32-bit Extraction package loaded in process 2124 at 0x74eb0000, image base 0x400000, stack from 0x186000-0x190000
2020-01-14 13:35:39,776 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Users\user\AppData\Local\Temp\T_C_FOR_.EXE".
2020-01-14 13:35:39,776 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00400000) returned 0x00000000.
2020-01-14 13:35:39,776 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:39,776 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00400000) -> AllocationBase 0x00400000 RegionSize 0x4096.
2020-01-14 13:35:39,776 [root] DEBUG: AddTrackedRegion: EntryPoint 0x123c, Entropy 6.677321e+00
2020-01-14 13:35:39,776 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions.
2020-01-14 13:35:39,776 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:35:39,776 [root] INFO: Monitor successfully loaded in process with pid 2124.
2020-01-14 13:35:39,822 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:39,822 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:39,822 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy 6.677321e+00.
2020-01-14 13:35:39,838 [root] DEBUG: ProtectionHandler: Adding region at 0x01ED0000 to tracked regions.
2020-01-14 13:35:39,838 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x01ED0000) returned 0x00000000.
2020-01-14 13:35:39,838 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:39,838 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x01ED0000) -> AllocationBase 0x01ED0000 RegionSize 0x24576.
2020-01-14 13:35:39,838 [root] DEBUG: AddTrackedRegion: New region at 0x01ED0000 size 0x6000 added to tracked regions.
2020-01-14 13:35:39,838 [root] DEBUG: ProtectionHandler: Address: 0x01ED0000 (alloc base 0x01ED0000), NumberOfBytesToProtect: 0x6000, NewAccessProtection: 0x20
2020-01-14 13:35:39,838 [root] DEBUG: ProtectionHandler: New code detected at (0x01ED0000), scanning for PE images.
2020-01-14 13:35:39,838 [root] DEBUG: DumpPEsInRange: Scanning range 0x1ed0000 - 0x1ed6000.
2020-01-14 13:35:39,838 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1ed0000-0x1ed6000.
2020-01-14 13:35:39,838 [root] DEBUG: DumpPEsInRange: Scanning range 0x1ed0000 - 0x1ed6000.
2020-01-14 13:35:39,838 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1ed0000-0x1ed6000.
2020-01-14 13:35:39,838 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x01ED0000, TrackedRegion->RegionSize: 0x6000, thread 2372
2020-01-14 13:35:39,838 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xcc, Size=0x2, Address=0x01ED0000 and Type=0x1.
2020-01-14 13:35:39,838 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2372 type 1 at address 0x01ED0000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:39,838 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x01ED0000
2020-01-14 13:35:39,838 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xcc, Size=0x4, Address=0x01ED003C and Type=0x1.
2020-01-14 13:35:39,854 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2372 type 1 at address 0x01ED003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:39,854 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x01ED003C
2020-01-14 13:35:39,854 [root] DEBUG: ProtectionHandler: Breakpoints set on executable region at: 0x01ED0000.
2020-01-14 13:35:39,854 [root] DEBUG: DLL loaded at 0x74E50000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-01-14 13:35:39,885 [root] DEBUG: ProtectionHandler: Address 0x01ED0000 already in tracked region at 0x01ED0000, size 0x6000
2020-01-14 13:35:39,885 [root] DEBUG: ProtectionHandler: Address: 0x01ED0000 (alloc base 0x01ED0000), NumberOfBytesToProtect: 0xa000, NewAccessProtection: 0x20
2020-01-14 13:35:39,885 [root] DEBUG: ProtectionHandler: Increased region size at 0x01ED0000 to 0xa000.
2020-01-14 13:35:39,885 [root] DEBUG: ProtectionHandler: New code detected at (0x01ED0000), scanning for PE images.
2020-01-14 13:35:39,885 [root] DEBUG: DumpPEsInRange: Scanning range 0x1ed0000 - 0x1eda000.
2020-01-14 13:35:39,885 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1ed0000-0x1eda000.
2020-01-14 13:35:39,901 [root] DEBUG: DumpPEsInRange: Scanning range 0x1ed0000 - 0x1eda000.
2020-01-14 13:35:39,901 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1ed0000-0x1eda000.
2020-01-14 13:35:39,901 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x01ED0000, TrackedRegion->RegionSize: 0xa000, thread 2372
2020-01-14 13:35:39,901 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xcc, Size=0x2, Address=0x01ED0000 and Type=0x1.
2020-01-14 13:35:39,901 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2372 type 1 at address 0x01ED0000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:39,901 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x01ED0000
2020-01-14 13:35:39,901 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xcc, Size=0x4, Address=0x01ED003C and Type=0x1.
2020-01-14 13:35:39,901 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2372 type 1 at address 0x01ED003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:39,901 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x01ED003C
2020-01-14 13:35:39,901 [root] DEBUG: ProtectionHandler: Breakpoints set on executable region at: 0x01ED0000.
2020-01-14 13:35:42,522 [root] DEBUG: Allocation: 0x01F20000 - 0x01F2E000, size: 0xe000, protection: 0x40.
2020-01-14 13:35:42,522 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:42,522 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:42,522 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy 6.690529e+00.
2020-01-14 13:35:42,522 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01ED0000.
2020-01-14 13:35:42,522 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x01F20000, size: 0xe000.
2020-01-14 13:35:42,522 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x01F20000) returned 0x00000000.
2020-01-14 13:35:42,522 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:42,538 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x01F20000) -> AllocationBase 0x01F20000 RegionSize 0x57344.
2020-01-14 13:35:42,538 [root] DEBUG: AddTrackedRegion: New region at 0x01F20000 size 0xe000 added to tracked regions.
2020-01-14 13:35:42,538 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x01F20000, TrackedRegion->RegionSize: 0xe000, thread 2372
2020-01-14 13:35:42,538 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x01ED0000 to 0x01F20000.
2020-01-14 13:35:42,538 [root] DEBUG: DumpPEsInRange: Scanning range 0x1ed0000 - 0x1eda000.
2020-01-14 13:35:42,538 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1ed0000-0x1eda000.
2020-01-14 13:35:42,538 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x01ED0000 - 0x01EDA000.
2020-01-14 13:35:42,538 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2124_178597048042351314212020 successfully created, size 0x10000
2020-01-14 13:35:42,538 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x1ed0000
2020-01-14 13:35:42,538 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x01ED0000 size 0x10000.
2020-01-14 13:35:42,538 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2124_95643000242351314212020 successfully created, size 0xa000
2020-01-14 13:35:42,552 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2124_95643000242351314212020
2020-01-14 13:35:42,552 [root] DEBUG: DumpRegion: Dumped stack region from 0x01ED0000, size 0xa000.
2020-01-14 13:35:42,552 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x01ED0000.
2020-01-14 13:35:42,552 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x1ed0000 - 0x1eda000.
2020-01-14 13:35:42,552 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xcc, Size=0x2, Address=0x01F20000 and Type=0x1.
2020-01-14 13:35:42,552 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2372 type 1 at address 0x01F20000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:42,552 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x01F20000
2020-01-14 13:35:42,552 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xcc, Size=0x4, Address=0x01F2003C and Type=0x1.
2020-01-14 13:35:42,552 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2372 type 1 at address 0x01F2003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:42,552 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x01F2003C
2020-01-14 13:35:42,552 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x01F20000 (size 0xe000).
2020-01-14 13:35:44,753 [root] DEBUG: DLL unloaded from 0x77B20000.
2020-01-14 13:35:44,753 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AC634 (thread 2372)
2020-01-14 13:35:44,753 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x01F2003C.
2020-01-14 13:35:44,753 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x60595f00 (at 0x01F2003C).
2020-01-14 13:35:44,753 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 2 within Context, Size=0x0, Address=0x01F20000 and Type=0x0.
2020-01-14 13:35:44,753 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x01F20000.
2020-01-14 13:35:44,753 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AC634 (thread 2372)
2020-01-14 13:35:44,767 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x01F20000.
2020-01-14 13:35:44,767 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x01F20000 already exists for thread 2372 (process 2124), skipping.
2020-01-14 13:35:44,767 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x1f20000: 0x41.
2020-01-14 13:35:44,767 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-01-14 13:35:44,767 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x01F20000 (thread 2372)
2020-01-14 13:35:44,767 [root] DEBUG: ShellcodeExecCallback: Breakpoint 2 at Address 0x01F20000 (allocation base 0x01F20000).
2020-01-14 13:35:44,767 [root] DEBUG: ShellcodeExecCallback: Debug: About to scan region for a PE image (base 0x01F20000, size 0xe000).
2020-01-14 13:35:44,767 [root] DEBUG: DumpPEsInRange: Scanning range 0x1f20000 - 0x1f2e000.
2020-01-14 13:35:44,767 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x1f20000-0x1f2e000.
2020-01-14 13:35:44,767 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2124_26972032044152114212020 successfully created, size 0xe000
2020-01-14 13:35:44,767 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2124_26972032044152114212020
2020-01-14 13:35:44,767 [root] DEBUG: ShellcodeExecCallback: successfully dumped memory range at 0x01F20000 (size 0xe000).
2020-01-14 13:35:44,767 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x1f20000 - 0x1f2e000.
2020-01-14 13:35:44,767 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x01F20000.
2020-01-14 13:35:44,767 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x01F2003C.
2020-01-14 13:35:44,767 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x01F20000.
2020-01-14 13:35:44,767 [root] DEBUG: set_caller_info: Adding region at 0x01F20000 to caller regions list (kernel32::SetErrorMode).
2020-01-14 13:35:44,767 [root] DEBUG: set_caller_info: Caller at 0x01F26419 in tracked regions.
2020-01-14 13:35:44,783 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:44,783 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:44,783 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy 6.690529e+00.
2020-01-14 13:35:44,783 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01ED0000.
2020-01-14 13:35:44,783 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01F20000.
2020-01-14 13:35:46,812 [root] DEBUG: DLL loaded at 0x75CA0000: C:\Windows\syswow64\shell32 (0xc4a000 bytes).
2020-01-14 13:35:47,015 [root] DEBUG: DLL loaded at 0x74CB0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes).
2020-01-14 13:35:47,062 [root] INFO: Announced 64-bit process name: explorer.exe pid: 1736
2020-01-14 13:35:47,062 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:47,062 [lib.api.process] INFO: 64-bit DLL to inject is C:\mmwcpkjad\dll\vRlBbyA.dll, loader C:\mmwcpkjad\bin\otGOKhGg.exe
2020-01-14 13:35:47,062 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:47,062 [root] DEBUG: Loader: Injecting process 1736 (thread 0) with C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:35:47,062 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed (SessionId=1).
2020-01-14 13:35:47,062 [root] DEBUG: Failed to inject DLL C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:35:47,062 [lib.api.process] ERROR: Unable to inject into 64-bit process with pid 1736, error: -15
2020-01-14 13:35:47,171 [root] DEBUG: DLL loaded at 0x74BB0000: C:\Windows\system32\PROPSYS (0xf5000 bytes).
2020-01-14 13:35:47,186 [root] DEBUG: DLL loaded at 0x77160000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-01-14 13:35:47,249 [root] DEBUG: DLL loaded at 0x74F90000: C:\Windows\system32\ntmarta (0x21000 bytes).
2020-01-14 13:35:47,263 [root] DEBUG: DLL loaded at 0x76AE0000: C:\Windows\syswow64\WLDAP32 (0x45000 bytes).
2020-01-14 13:35:47,296 [root] DEBUG: DLL loaded at 0x74BA0000: C:\Windows\system32\profapi (0xb000 bytes).
2020-01-14 13:35:47,420 [root] DEBUG: DLL loaded at 0x771F0000: C:\Windows\syswow64\SETUPAPI (0x19d000 bytes).
2020-01-14 13:35:47,436 [root] DEBUG: DLL loaded at 0x77130000: C:\Windows\syswow64\CFGMGR32 (0x27000 bytes).
2020-01-14 13:35:47,436 [root] DEBUG: DLL loaded at 0x757C0000: C:\Windows\syswow64\DEVOBJ (0x12000 bytes).
2020-01-14 13:35:47,436 [root] DEBUG: DLL unloaded from 0x75CA0000.
2020-01-14 13:35:47,497 [root] DEBUG: DLL loaded at 0x75130000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-01-14 13:35:48,154 [root] DEBUG: DLL loaded at 0x74B40000: C:\Windows\System32\shdocvw (0x2e000 bytes).
2020-01-14 13:35:48,371 [root] DEBUG: DLL loaded at 0x76DB0000: C:\Windows\SysWOW64\urlmon (0x136000 bytes).
2020-01-14 13:35:48,512 [root] DEBUG: DLL loaded at 0x77020000: C:\Windows\syswow64\WININET (0xf5000 bytes).
2020-01-14 13:35:48,559 [root] DEBUG: DLL loaded at 0x76B90000: C:\Windows\syswow64\iertutil (0x1fb000 bytes).
2020-01-14 13:35:48,575 [root] DEBUG: DLL loaded at 0x76F00000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2020-01-14 13:35:48,575 [root] DEBUG: DLL loaded at 0x77AF0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-01-14 13:35:49,073 [root] INFO: Announced 32-bit process name: wscript.exe pid: 2408
2020-01-14 13:35:49,073 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:49,073 [lib.api.process] INFO: 32-bit DLL to inject is C:\mmwcpkjad\dll\XrozDnA.dll, loader C:\mmwcpkjad\bin\JiNnMnG.exe
2020-01-14 13:35:49,073 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:49,073 [root] DEBUG: Loader: Injecting process 2408 (thread 2432) with C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,073 [root] DEBUG: Process image base: 0x00320000
2020-01-14 13:35:49,073 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,089 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-01-14 13:35:49,089 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,089 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2408
2020-01-14 13:35:49,151 [root] INFO: Announced 32-bit process name: wscript.exe pid: 2408
2020-01-14 13:35:49,151 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:49,151 [lib.api.process] INFO: 32-bit DLL to inject is C:\mmwcpkjad\dll\XrozDnA.dll, loader C:\mmwcpkjad\bin\JiNnMnG.exe
2020-01-14 13:35:49,151 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:49,151 [root] DEBUG: Loader: Injecting process 2408 (thread 2432) with C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,151 [root] DEBUG: Process image base: 0x00320000
2020-01-14 13:35:49,151 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,151 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-01-14 13:35:49,167 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,167 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2408
2020-01-14 13:35:49,167 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:35:49,167 [root] INFO: Announced 32-bit process name: filename.exe pid: 2728
2020-01-14 13:35:49,167 [root] DEBUG: Process dumps disabled.
2020-01-14 13:35:49,167 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:49,167 [lib.api.process] INFO: 32-bit DLL to inject is C:\mmwcpkjad\dll\XrozDnA.dll, loader C:\mmwcpkjad\bin\JiNnMnG.exe
2020-01-14 13:35:49,167 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:49,183 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:49,183 [root] DEBUG: Loader: Injecting process 2728 (thread 2704) with C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,183 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:49,183 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,183 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-01-14 13:35:49,183 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-01-14 13:35:49,183 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77940000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7799124a, Wow64PrepareForException: 0x0
2020-01-14 13:35:49,183 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,183 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x130000
2020-01-14 13:35:49,183 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2728
2020-01-14 13:35:49,183 [root] DEBUG: Debugger initialised.
2020-01-14 13:35:49,183 [root] DEBUG: CAPE initialised: 32-bit Extraction package loaded in process 2408 at 0x74eb0000, image base 0x320000, stack from 0x4a6000-0x4b0000
2020-01-14 13:35:49,183 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Windows\System32\WScript.exe" "C:\Users\user\subfolder\filename.vbs".
2020-01-14 13:35:49,183 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00320000) returned 0x00000000.
2020-01-14 13:35:49,183 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:49,183 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00320000) -> AllocationBase 0x00320000 RegionSize 0x4096.
2020-01-14 13:35:49,183 [root] DEBUG: AddTrackedRegion: EntryPoint 0x2f3b, Entropy 5.628195e+00
2020-01-14 13:35:49,183 [root] DEBUG: AddTrackedRegion: New region at 0x00320000 size 0x1000 added to tracked regions.
2020-01-14 13:35:49,183 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:35:49,183 [root] INFO: Added new process to list with pid: 2408
2020-01-14 13:35:49,183 [root] INFO: Monitor successfully loaded in process with pid 2408.
2020-01-14 13:35:49,183 [root] DEBUG: DLL unloaded from 0x75B90000.
2020-01-14 13:35:49,198 [root] DEBUG: DLL unloaded from 0x00320000.
2020-01-14 13:35:49,198 [root] DEBUG: DLL loaded at 0x74E50000: C:\Windows\SysWOW64\SXS (0x5f000 bytes).
2020-01-14 13:35:49,198 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1832.
2020-01-14 13:35:49,198 [root] DEBUG: DLL unloaded from 0x77B20000.
2020-01-14 13:35:49,198 [root] DEBUG: DLL loaded at 0x77160000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-01-14 13:35:49,260 [root] INFO: Announced 32-bit process name: filename.exe pid: 2728
2020-01-14 13:35:49,260 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:49,260 [lib.api.process] INFO: 32-bit DLL to inject is C:\mmwcpkjad\dll\XrozDnA.dll, loader C:\mmwcpkjad\bin\JiNnMnG.exe
2020-01-14 13:35:49,260 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:49,260 [root] DEBUG: Loader: Injecting process 2728 (thread 2704) with C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,260 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:49,260 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,276 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-01-14 13:35:49,276 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:49,276 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2728
2020-01-14 13:35:49,276 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2124).
2020-01-14 13:35:49,276 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:49,276 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:49,276 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy -nan(ind).
2020-01-14 13:35:49,276 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01ED0000.
2020-01-14 13:35:49,276 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x01F20000.
2020-01-14 13:35:49,276 [root] INFO: Notified of termination of process with pid 2124.
2020-01-14 13:35:49,276 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:35:49,276 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 2124).
2020-01-14 13:35:49,276 [root] DEBUG: Process dumps disabled.
2020-01-14 13:35:49,292 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:49,308 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-01-14 13:35:49,323 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77940000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7799124a, Wow64PrepareForException: 0x0
2020-01-14 13:35:49,338 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x230000
2020-01-14 13:35:49,338 [root] DEBUG: Debugger initialised.
2020-01-14 13:35:49,338 [root] DEBUG: CAPE initialised: 32-bit Extraction package loaded in process 2728 at 0x74eb0000, image base 0x400000, stack from 0x186000-0x190000
2020-01-14 13:35:49,355 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Users\user\subfolder\filename.exe".
2020-01-14 13:35:49,369 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00400000) returned 0x00000000.
2020-01-14 13:35:49,369 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:49,369 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00400000) -> AllocationBase 0x00400000 RegionSize 0x4096.
2020-01-14 13:35:49,369 [root] DEBUG: AddTrackedRegion: EntryPoint 0x123c, Entropy 6.677321e+00
2020-01-14 13:35:49,369 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions.
2020-01-14 13:35:49,385 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:35:49,385 [root] INFO: Added new process to list with pid: 2728
2020-01-14 13:35:49,385 [root] INFO: Monitor successfully loaded in process with pid 2728.
2020-01-14 13:35:49,385 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:49,417 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:49,417 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy 6.677321e+00.
2020-01-14 13:35:49,417 [root] DEBUG: ProtectionHandler: Adding region at 0x003D0000 to tracked regions.
2020-01-14 13:35:49,417 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x003D0000) returned 0x00000000.
2020-01-14 13:35:49,417 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:49,417 [root] DEBUG: DLL loaded at 0x74DE0000: C:\Windows\SysWOW64\vbscript (0x6b000 bytes).
2020-01-14 13:35:49,417 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x003D0000) -> AllocationBase 0x003D0000 RegionSize 0x24576.
2020-01-14 13:35:49,433 [root] DEBUG: AddTrackedRegion: New region at 0x003D0000 size 0x6000 added to tracked regions.
2020-01-14 13:35:49,433 [root] DEBUG: ProtectionHandler: Address: 0x003D0000 (alloc base 0x003D0000), NumberOfBytesToProtect: 0x6000, NewAccessProtection: 0x20
2020-01-14 13:35:49,433 [root] DEBUG: ProtectionHandler: New code detected at (0x003D0000), scanning for PE images.
2020-01-14 13:35:49,433 [root] DEBUG: DumpPEsInRange: Scanning range 0x3d0000 - 0x3d6000.
2020-01-14 13:35:49,433 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d0000-0x3d6000.
2020-01-14 13:35:49,433 [root] DEBUG: DumpPEsInRange: Scanning range 0x3d0000 - 0x3d6000.
2020-01-14 13:35:49,447 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d0000-0x3d6000.
2020-01-14 13:35:49,447 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003D0000, TrackedRegion->RegionSize: 0x6000, thread 2704
2020-01-14 13:35:49,463 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xcc, Size=0x2, Address=0x003D0000 and Type=0x1.
2020-01-14 13:35:49,463 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2704 type 1 at address 0x003D0000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:49,480 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003D0000
2020-01-14 13:35:49,480 [root] DEBUG: DLL loaded at 0x75AA0000: C:\Windows\syswow64\WINTRUST (0x2d000 bytes).
2020-01-14 13:35:49,480 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xcc, Size=0x4, Address=0x003D003C and Type=0x1.
2020-01-14 13:35:49,480 [root] DEBUG: DLL loaded at 0x76F00000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2020-01-14 13:35:49,480 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2704 type 1 at address 0x003D003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:49,480 [root] DEBUG: DLL loaded at 0x77AF0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-01-14 13:35:49,494 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003D003C
2020-01-14 13:35:49,494 [root] DEBUG: DLL loaded at 0x75630000: C:\Windows\SysWOW64\CRYPTSP (0x16000 bytes).
2020-01-14 13:35:49,494 [root] DEBUG: ProtectionHandler: Breakpoints set on executable region at: 0x003D0000.
2020-01-14 13:35:49,510 [root] DEBUG: DLL loaded at 0x755F0000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-01-14 13:35:49,526 [root] DEBUG: DLL loaded at 0x74E50000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-01-14 13:35:49,542 [root] DEBUG: DLL loaded at 0x74DD0000: C:\Windows\SysWOW64\MSISIP (0x8000 bytes).
2020-01-14 13:35:49,542 [root] DEBUG: ProtectionHandler: Address 0x003D0000 already in tracked region at 0x003D0000, size 0x6000
2020-01-14 13:35:49,542 [root] DEBUG: ProtectionHandler: Address: 0x003D0000 (alloc base 0x003D0000), NumberOfBytesToProtect: 0xa000, NewAccessProtection: 0x20
2020-01-14 13:35:49,542 [root] DEBUG: ProtectionHandler: Increased region size at 0x003D0000 to 0xa000.
2020-01-14 13:35:49,558 [root] DEBUG: ProtectionHandler: New code detected at (0x003D0000), scanning for PE images.
2020-01-14 13:35:49,558 [root] DEBUG: DLL unloaded from 0x77390000.
2020-01-14 13:35:49,558 [root] DEBUG: DumpPEsInRange: Scanning range 0x3d0000 - 0x3da000.
2020-01-14 13:35:49,558 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d0000-0x3da000.
2020-01-14 13:35:49,572 [root] DEBUG: DumpPEsInRange: Scanning range 0x3d0000 - 0x3da000.
2020-01-14 13:35:49,572 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d0000-0x3da000.
2020-01-14 13:35:49,572 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003D0000, TrackedRegion->RegionSize: 0xa000, thread 2704
2020-01-14 13:35:49,588 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xcc, Size=0x2, Address=0x003D0000 and Type=0x1.
2020-01-14 13:35:49,588 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2704 type 1 at address 0x003D0000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:49,588 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003D0000
2020-01-14 13:35:49,588 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xcc, Size=0x4, Address=0x003D003C and Type=0x1.
2020-01-14 13:35:49,588 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2704 type 1 at address 0x003D003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:49,588 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003D003C
2020-01-14 13:35:49,588 [root] DEBUG: ProtectionHandler: Breakpoints set on executable region at: 0x003D0000.
2020-01-14 13:35:49,776 [root] DEBUG: DLL loaded at 0x74DB0000: C:\Windows\SysWOW64\wshext (0x16000 bytes).
2020-01-14 13:35:49,792 [root] DEBUG: DLL loaded at 0x75060000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32 (0x84000 bytes).
2020-01-14 13:35:49,792 [root] DEBUG: DLL loaded at 0x75CA0000: C:\Windows\syswow64\SHELL32 (0xc4a000 bytes).
2020-01-14 13:35:50,104 [root] DEBUG: DLL loaded at 0x74D80000: C:\Windows\SysWOW64\scrobj (0x2d000 bytes).
2020-01-14 13:35:50,134 [root] DEBUG: DLL unloaded from 0x77580000.
2020-01-14 13:35:50,509 [root] DEBUG: DLL loaded at 0x74D50000: C:\Windows\SysWOW64\wshom.ocx (0x21000 bytes).
2020-01-14 13:35:50,555 [root] DEBUG: DLL loaded at 0x74D30000: C:\Windows\SysWOW64\MPR (0x12000 bytes).
2020-01-14 13:35:50,743 [root] DEBUG: DLL loaded at 0x74D00000: C:\Windows\SysWOW64\ScrRun (0x2a000 bytes).
2020-01-14 13:35:51,756 [root] DEBUG: Allocation: 0x004E0000 - 0x004EE000, size: 0xe000, protection: 0x40.
2020-01-14 13:35:51,773 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:51,788 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:51,803 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy 6.690526e+00.
2020-01-14 13:35:51,803 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-01-14 13:35:51,803 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x004E0000, size: 0xe000.
2020-01-14 13:35:51,819 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x004E0000) returned 0x00000000.
2020-01-14 13:35:51,835 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:51,835 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x004E0000) -> AllocationBase 0x004E0000 RegionSize 0x57344.
2020-01-14 13:35:51,835 [root] DEBUG: AddTrackedRegion: New region at 0x004E0000 size 0xe000 added to tracked regions.
2020-01-14 13:35:51,835 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x004E0000, TrackedRegion->RegionSize: 0xe000, thread 2704
2020-01-14 13:35:51,835 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x003D0000 to 0x004E0000.
2020-01-14 13:35:51,835 [root] DEBUG: DumpPEsInRange: Scanning range 0x3d0000 - 0x3da000.
2020-01-14 13:35:51,865 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3d0000-0x3da000.
2020-01-14 13:35:51,881 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x003D0000 - 0x003DA000.
2020-01-14 13:35:51,881 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2728_202254825451351314212020 successfully created, size 0x10000
2020-01-14 13:35:51,898 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x3d0000
2020-01-14 13:35:51,898 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x003D0000 size 0x10000.
2020-01-14 13:35:51,913 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2728_92539800051351314212020 successfully created, size 0xa000
2020-01-14 13:35:51,928 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2728_92539800051351314212020
2020-01-14 13:35:51,928 [root] DEBUG: DumpRegion: Dumped stack region from 0x003D0000, size 0xa000.
2020-01-14 13:35:51,944 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003D0000.
2020-01-14 13:35:51,944 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3d0000 - 0x3da000.
2020-01-14 13:35:51,960 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xcc, Size=0x2, Address=0x004E0000 and Type=0x1.
2020-01-14 13:35:51,960 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2704 type 1 at address 0x004E0000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:51,976 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x004E0000
2020-01-14 13:35:51,990 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xcc, Size=0x4, Address=0x004E003C and Type=0x1.
2020-01-14 13:35:51,990 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2704 type 1 at address 0x004E003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:51,990 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x004E003C
2020-01-14 13:35:52,006 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x004E0000 (size 0xe000).
2020-01-14 13:35:53,987 [root] DEBUG: DLL unloaded from 0x77B20000.
2020-01-14 13:35:53,987 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AC634 (thread 2704)
2020-01-14 13:35:53,987 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x004E003C.
2020-01-14 13:35:54,003 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x60595f00 (at 0x004E003C).
2020-01-14 13:35:54,019 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 2 within Context, Size=0x0, Address=0x004E0000 and Type=0x0.
2020-01-14 13:35:54,019 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x004E0000.
2020-01-14 13:35:54,019 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AC634 (thread 2704)
2020-01-14 13:35:54,019 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x004E0000.
2020-01-14 13:35:54,019 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x004E0000 already exists for thread 2704 (process 2728), skipping.
2020-01-14 13:35:54,019 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x4e0000: 0x41.
2020-01-14 13:35:54,019 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-01-14 13:35:54,049 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004E0000 (thread 2704)
2020-01-14 13:35:54,065 [root] DEBUG: ShellcodeExecCallback: Breakpoint 2 at Address 0x004E0000 (allocation base 0x004E0000).
2020-01-14 13:35:54,065 [root] DEBUG: ShellcodeExecCallback: Debug: About to scan region for a PE image (base 0x004E0000, size 0xe000).
2020-01-14 13:35:54,082 [root] DEBUG: DumpPEsInRange: Scanning range 0x4e0000 - 0x4ee000.
2020-01-14 13:35:54,096 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x4e0000-0x4ee000.
2020-01-14 13:35:54,112 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2728_105067812254152114212020 successfully created, size 0xe000
2020-01-14 13:35:54,112 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2728_105067812254152114212020
2020-01-14 13:35:54,112 [root] DEBUG: ShellcodeExecCallback: successfully dumped memory range at 0x004E0000 (size 0xe000).
2020-01-14 13:35:54,112 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x4e0000 - 0x4ee000.
2020-01-14 13:35:54,112 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x004E0000.
2020-01-14 13:35:54,128 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x004E003C.
2020-01-14 13:35:54,128 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x004E0000.
2020-01-14 13:35:54,128 [root] DEBUG: set_caller_info: Adding region at 0x004E0000 to caller regions list (kernel32::SetErrorMode).
2020-01-14 13:35:54,144 [root] DEBUG: set_caller_info: Caller at 0x004E6419 in tracked regions.
2020-01-14 13:35:54,144 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:54,160 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:54,160 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy 6.690526e+00.
2020-01-14 13:35:54,160 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-01-14 13:35:54,160 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x004E0000.
2020-01-14 13:35:56,187 [root] DEBUG: DLL loaded at 0x75CA0000: C:\Windows\syswow64\shell32 (0xc4a000 bytes).
2020-01-14 13:35:56,280 [root] INFO: Announced 32-bit process name: filename.exe pid: 2612
2020-01-14 13:35:56,280 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:56,280 [lib.api.process] INFO: 32-bit DLL to inject is C:\mmwcpkjad\dll\XrozDnA.dll, loader C:\mmwcpkjad\bin\JiNnMnG.exe
2020-01-14 13:35:56,296 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:56,328 [root] DEBUG: Loader: Injecting process 2612 (thread 2616) with C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,328 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:56,328 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,328 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-01-14 13:35:56,328 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,328 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2612
2020-01-14 13:35:56,328 [root] DEBUG: DLL unloaded from 0x00400000.
2020-01-14 13:35:56,358 [root] DEBUG: DLL loaded at 0x75130000: C:\Windows\system32\apphelp (0x4c000 bytes).
2020-01-14 13:35:56,375 [root] INFO: Announced 32-bit process name: filename.exe pid: 2612
2020-01-14 13:35:56,375 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:56,375 [lib.api.process] INFO: 32-bit DLL to inject is C:\mmwcpkjad\dll\XrozDnA.dll, loader C:\mmwcpkjad\bin\JiNnMnG.exe
2020-01-14 13:35:56,390 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:56,390 [root] DEBUG: Loader: Injecting process 2612 (thread 2616) with C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,390 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:56,390 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,421 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-01-14 13:35:56,421 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,421 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2612
2020-01-14 13:35:56,421 [root] INFO: Announced 32-bit process name: filename.exe pid: 2612
2020-01-14 13:35:56,437 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:35:56,437 [lib.api.process] INFO: 32-bit DLL to inject is C:\mmwcpkjad\dll\XrozDnA.dll, loader C:\mmwcpkjad\bin\JiNnMnG.exe
2020-01-14 13:35:56,467 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:35:56,467 [root] DEBUG: Loader: Injecting process 2612 (thread 2616) with C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,467 [root] DEBUG: Process image base: 0x00400000
2020-01-14 13:35:56,467 [root] DEBUG: InjectDllViaIAT: Modified EP detected, rebasing IAT patch to new image base 0x00400000 (context EP 0x004AACF9)
2020-01-14 13:35:56,483 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,483 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-01-14 13:35:56,500 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\XrozDnA.dll.
2020-01-14 13:35:56,500 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 2612
2020-01-14 13:35:56,515 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2728).
2020-01-14 13:35:56,515 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:35:56,530 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:56,530 [root] DEBUG: Process dumps disabled.
2020-01-14 13:35:56,530 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:56,546 [root] INFO: Disabling sleep skipping.
2020-01-14 13:35:56,546 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy -nan(ind).
2020-01-14 13:35:56,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003D0000.
2020-01-14 13:35:56,562 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-01-14 13:35:56,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x004E0000.
2020-01-14 13:35:56,562 [root] DEBUG: WoW64 detected: 64-bit ntdll base: 0x77940000, KiUserExceptionDispatcher: 0x0, NtSetContextThread: 0x7799124a, Wow64PrepareForException: 0x0
2020-01-14 13:35:56,562 [root] INFO: Notified of termination of process with pid 2728.
2020-01-14 13:35:56,562 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 2728).
2020-01-14 13:35:56,562 [root] DEBUG: WoW64 workaround: KiUserExceptionDispatcher hook installed at: 0x2f0000
2020-01-14 13:35:56,562 [root] DEBUG: Debugger initialised.
2020-01-14 13:35:56,562 [root] DEBUG: CAPE initialised: 32-bit Extraction package loaded in process 2612 at 0x74eb0000, image base 0x400000, stack from 0x186000-0x190000
2020-01-14 13:35:56,578 [root] DEBUG: Commandline: C:\Users\user\AppData\Local\Temp\"C:\Users\user\subfolder\filename.exe".
2020-01-14 13:35:56,578 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00400000) returned 0x00000000.
2020-01-14 13:35:56,578 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:56,592 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00400000) -> AllocationBase 0x00400000 RegionSize 0x4096.
2020-01-14 13:35:56,592 [root] DEBUG: AddTrackedRegion: EntryPoint 0x123c, Entropy 6.677321e+00
2020-01-14 13:35:56,608 [root] DEBUG: AddTrackedRegion: New region at 0x00400000 size 0x1000 added to tracked regions.
2020-01-14 13:35:56,608 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:35:56,608 [root] INFO: Added new process to list with pid: 2612
2020-01-14 13:35:56,608 [root] INFO: Monitor successfully loaded in process with pid 2612.
2020-01-14 13:35:56,624 [root] DEBUG: Allocation: 0x00300000 - 0x0030E000, size: 0xe000, protection: 0x40.
2020-01-14 13:35:56,624 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:56,655 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:35:56,655 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy 6.677321e+00.
2020-01-14 13:35:56,655 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00300000, size: 0xe000.
2020-01-14 13:35:56,655 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00300000) returned 0x00000000.
2020-01-14 13:35:56,655 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:35:56,655 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00300000) -> AllocationBase 0x00300000 RegionSize 0x57344.
2020-01-14 13:35:56,655 [root] DEBUG: AddTrackedRegion: New region at 0x00300000 size 0xe000 added to tracked regions.
2020-01-14 13:35:56,671 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x00300000, TrackedRegion->RegionSize: 0xe000, thread 2616
2020-01-14 13:35:56,671 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xcc, Size=0x2, Address=0x00300000 and Type=0x1.
2020-01-14 13:35:56,671 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2616 type 1 at address 0x00300000, size 2 with Callback 0x74eb7510.
2020-01-14 13:35:56,671 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x00300000
2020-01-14 13:35:56,671 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xcc, Size=0x4, Address=0x0030003C and Type=0x1.
2020-01-14 13:35:56,671 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2616 type 1 at address 0x0030003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:35:56,671 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x0030003C
2020-01-14 13:35:56,671 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x00300000 (size 0xe000).
2020-01-14 13:35:57,186 [root] DEBUG: DLL unloaded from 0x74D50000.
2020-01-14 13:35:57,186 [root] DEBUG: DLL unloaded from 0x74D80000.
2020-01-14 13:35:57,247 [root] DEBUG: DLL unloaded from 0x74DE0000.
2020-01-14 13:35:57,247 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2408).
2020-01-14 13:35:57,311 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:57,311 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00320000.
2020-01-14 13:35:57,311 [root] DEBUG: ProcessImageBase: EP 0x00002F3B image base 0x00320000 size 0x0 entropy 5.628506e+00.
2020-01-14 13:35:57,372 [root] DEBUG: ClearAllBreakpoints: Error getting thread context for thread 1832.
2020-01-14 13:35:57,436 [root] DEBUG: DLL unloaded from 0x76B30000.
2020-01-14 13:35:57,545 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 2408).
2020-01-14 13:35:57,545 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:35:57,559 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00320000.
2020-01-14 13:35:57,607 [root] DEBUG: ProcessImageBase: EP 0x00002F3B image base 0x00320000 size 0x0 entropy 5.628506e+00.
2020-01-14 13:35:57,607 [root] DEBUG: ClearAllBreakpoints: Error getting thread context for thread 1832.
2020-01-14 13:35:57,684 [root] INFO: Notified of termination of process with pid 2408.
2020-01-14 13:36:01,148 [root] DEBUG: DLL unloaded from 0x77B20000.
2020-01-14 13:36:01,164 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AC634 (thread 2616)
2020-01-14 13:36:01,164 [root] DEBUG: PEPointerWriteCallback: Breakpoint 1 at Address 0x0030003C.
2020-01-14 13:36:01,164 [root] DEBUG: PEPointerWriteCallback: candidate pointer to PE header too big: 0x60595f00 (at 0x0030003C).
2020-01-14 13:36:01,180 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 2 within Context, Size=0x0, Address=0x00300000 and Type=0x0.
2020-01-14 13:36:01,180 [root] DEBUG: PEPointerWriteCallback: set write bp on AddressOfEntryPoint at 0x00300000.
2020-01-14 13:36:01,180 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x004AC634 (thread 2616)
2020-01-14 13:36:01,180 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x00300000.
2020-01-14 13:36:01,194 [root] DEBUG: ContextSetNextAvailableBreakpoint: An identical breakpoint (2) at 0x00300000 already exists for thread 2616 (process 2612), skipping.
2020-01-14 13:36:01,194 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x300000: 0x41.
2020-01-14 13:36:01,194 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-01-14 13:36:01,194 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x00300000 (thread 2616)
2020-01-14 13:36:01,194 [root] DEBUG: ShellcodeExecCallback: Breakpoint 2 at Address 0x00300000 (allocation base 0x00300000).
2020-01-14 13:36:01,194 [root] DEBUG: ShellcodeExecCallback: Debug: About to scan region for a PE image (base 0x00300000, size 0xe000).
2020-01-14 13:36:01,194 [root] DEBUG: DumpPEsInRange: Scanning range 0x300000 - 0x30e000.
2020-01-14 13:36:01,210 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x300000-0x30e000.
2020-01-14 13:36:01,210 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_9308209811162114212020 successfully created, size 0xe000
2020-01-14 13:36:01,226 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_9308209811162114212020
2020-01-14 13:36:01,226 [root] DEBUG: ShellcodeExecCallback: successfully dumped memory range at 0x00300000 (size 0xe000).
2020-01-14 13:36:01,226 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x300000 - 0x30e000.
2020-01-14 13:36:01,226 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x00300000.
2020-01-14 13:36:01,242 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x0030003C.
2020-01-14 13:36:01,242 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x00300000.
2020-01-14 13:36:01,242 [root] DEBUG: set_caller_info: Adding region at 0x00300000 to caller regions list (kernel32::SetErrorMode).
2020-01-14 13:36:01,242 [root] DEBUG: set_caller_info: Caller at 0x00306419 in tracked regions.
2020-01-14 13:36:01,257 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:01,257 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:01,257 [root] DEBUG: ProcessImageBase: EP 0x0000123C image base 0x00400000 size 0x0 entropy 6.677321e+00.
2020-01-14 13:36:01,257 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:03,286 [root] DEBUG: DLL loaded at 0x75CA0000: C:\Windows\syswow64\shell32 (0xc4a000 bytes).
2020-01-14 13:36:03,394 [root] DEBUG: ProtectionHandler: Address 0x00401000 already in tracked region at 0x00400000, size 0x1000
2020-01-14 13:36:03,394 [root] DEBUG: ProtectionHandler: Address: 0x00401000 (alloc base 0x00400000), NumberOfBytesToProtect: 0x1967f, NewAccessProtection: 0x20
2020-01-14 13:36:03,410 [root] DEBUG: ProtectionHandler: Increased region size at 0x00401000 to 0x1a67f.
2020-01-14 13:36:03,410 [root] DEBUG: ProtectionHandler: Updated region protection at 0x00401000 to 0x20.
2020-01-14 13:36:03,410 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy -nan(ind).
2020-01-14 13:36:03,410 [root] DEBUG: ProcessImageBase: Modified entry point (0x0000FFEF) detected at image base 0x00400000 - dumping.
2020-01-14 13:36:03,410 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:03,410 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x00400000.
2020-01-14 13:36:03,410 [root] DEBUG: DumpProcess: Module entry point VA is 0x0000FFEF.
2020-01-14 13:36:03,457 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_5381643943361314212020
2020-01-14 13:36:03,457 [root] DEBUG: DumpProcess: Module image dump success - dump size 0x21c00.
2020-01-14 13:36:03,473 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2712.
2020-01-14 13:36:03,473 [root] DEBUG: DLL loaded at 0x74E60000: C:\Windows\system32\mscoree (0x4a000 bytes).
2020-01-14 13:36:03,503 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:03,551 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:03,565 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.111876e+00.
2020-01-14 13:36:03,612 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:03,612 [root] DEBUG: ProtectionHandler: Adding region at 0x000C2000 to tracked regions.
2020-01-14 13:36:03,612 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x000C2000) returned 0x00000000.
2020-01-14 13:36:03,612 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:03,628 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x000C2000) -> AllocationBase 0x000C0000 RegionSize 0x299008.
2020-01-14 13:36:03,644 [root] DEBUG: AddTrackedRegion: EntryPoint 0x4a46e, Entropy 6.202875e+00
2020-01-14 13:36:03,644 [root] DEBUG: AddTrackedRegion: New region at 0x000C0000 size 0x49000 added to tracked regions.
2020-01-14 13:36:03,721 [root] DEBUG: ProtectionHandler: Address: 0x000C2000 (alloc base 0x000C0000), NumberOfBytesToProtect: 0x48600, NewAccessProtection: 0x20
2020-01-14 13:36:03,721 [root] DEBUG: ProtectionHandler: Increased region size at 0x000C2000 to 0x4a600.
2020-01-14 13:36:03,721 [root] DEBUG: ProtectionHandler: New code detected at (0x000C0000), scanning for PE images.
2020-01-14 13:36:03,721 [root] DEBUG: DumpPEsInRange: Scanning range 0xc0000 - 0x10a600.
2020-01-14 13:36:03,737 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0xc0000
2020-01-14 13:36:03,737 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-01-14 13:36:03,737 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x000C0000.
2020-01-14 13:36:03,785 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_18870832483361314212020
2020-01-14 13:36:03,799 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x5b400.
2020-01-14 13:36:03,799 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 2 of 101, RVA 0x50cbc01 and size 0x1301050c.
2020-01-14 13:36:03,815 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x10402a
2020-01-14 13:36:03,815 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump 'raw' PE image.
2020-01-14 13:36:03,815 [root] DEBUG: DumpPE: Instantiating PeParser with address: 0x0010402A.
2020-01-14 13:36:03,832 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_5140076483361314212020
2020-01-14 13:36:03,832 [root] DEBUG: DumpPE: PE file in memory dumped successfully - dump size 0x4200.
2020-01-14 13:36:03,832 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x10422a-0x10a600.
2020-01-14 13:36:03,832 [root] DEBUG: ProtectionHandler: PE image(s) dumped from 0x000C0000.
2020-01-14 13:36:03,846 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0xc0000 - 0x10a600.
2020-01-14 13:36:03,846 [root] DEBUG: set_caller_info: Adding region at 0x20070000 to caller regions list (advapi32::RegQueryInfoKeyW).
2020-01-14 13:36:03,846 [root] DEBUG: set_caller_info: Adding region at 0x01EB0000 to caller regions list (advapi32::RegOpenKeyExW).
2020-01-14 13:36:03,846 [root] DEBUG: set_caller_info: Adding region at 0x004F0000 to caller regions list (kernel32::FindFirstFileExW).
2020-01-14 13:36:03,846 [root] DEBUG: DLL loaded at 0x74DE0000: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei (0x7b000 bytes).
2020-01-14 13:36:03,862 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:03,862 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:03,862 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113938e+00.
2020-01-14 13:36:03,862 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:03,862 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:03,878 [root] DEBUG: ProtectionHandler: Adding region at 0x000B1388 to tracked regions.
2020-01-14 13:36:03,878 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x000B1388) returned 0x00000000.
2020-01-14 13:36:03,878 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:03,878 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x000B1388) -> AllocationBase 0x000B0000 RegionSize 0x4096.
2020-01-14 13:36:03,878 [root] DEBUG: AddTrackedRegion: New region at 0x000B0000 size 0x1000 added to tracked regions.
2020-01-14 13:36:03,878 [root] DEBUG: ProtectionHandler: Address: 0x000B1388 (alloc base 0x000B0000), NumberOfBytesToProtect: 0xa, NewAccessProtection: 0x40
2020-01-14 13:36:03,878 [root] DEBUG: ProtectionHandler: Increased region size at 0x000B1388 to 0x1392.
2020-01-14 13:36:03,894 [root] DEBUG: ProtectionHandler: New code detected at (0x000B0000), scanning for PE images.
2020-01-14 13:36:03,894 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb1392.
2020-01-14 13:36:03,894 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb1392.
2020-01-14 13:36:03,894 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb1392.
2020-01-14 13:36:03,894 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb1392.
2020-01-14 13:36:03,910 [root] DEBUG: ProtectionHandler: Address 0x000B13A0 already in tracked region at 0x000B0000, size 0x1392
2020-01-14 13:36:03,910 [root] DEBUG: ProtectionHandler: Address: 0x000B13A0 (alloc base 0x000B0000), NumberOfBytesToProtect: 0xa, NewAccessProtection: 0x40
2020-01-14 13:36:03,910 [root] DEBUG: ProtectionHandler: Increased region size at 0x000B13A0 to 0x13aa.
2020-01-14 13:36:03,910 [root] DEBUG: ProtectionHandler: New code detected at (0x000B0000), scanning for PE images.
2020-01-14 13:36:03,910 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb13aa.
2020-01-14 13:36:03,910 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb13aa.
2020-01-14 13:36:03,924 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb13aa.
2020-01-14 13:36:03,924 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb13aa.
2020-01-14 13:36:03,924 [root] DEBUG: ProtectionHandler: Address 0x000B13B8 already in tracked region at 0x000B0000, size 0x13aa
2020-01-14 13:36:03,924 [root] DEBUG: ProtectionHandler: Address: 0x000B13B8 (alloc base 0x000B0000), NumberOfBytesToProtect: 0xa, NewAccessProtection: 0x40
2020-01-14 13:36:03,924 [root] DEBUG: ProtectionHandler: Increased region size at 0x000B13B8 to 0x13c2.
2020-01-14 13:36:03,924 [root] DEBUG: ProtectionHandler: New code detected at (0x000B0000), scanning for PE images.
2020-01-14 13:36:03,924 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb13c2.
2020-01-14 13:36:03,940 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb13c2.
2020-01-14 13:36:03,940 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb13c2.
2020-01-14 13:36:03,940 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb13c2.
2020-01-14 13:36:03,956 [root] DEBUG: ProtectionHandler: Address 0x000B13D0 already in tracked region at 0x000B0000, size 0x13c2
2020-01-14 13:36:03,956 [root] DEBUG: ProtectionHandler: Address: 0x000B13D0 (alloc base 0x000B0000), NumberOfBytesToProtect: 0xa, NewAccessProtection: 0x40
2020-01-14 13:36:03,956 [root] DEBUG: ProtectionHandler: Increased region size at 0x000B13D0 to 0x13da.
2020-01-14 13:36:03,956 [root] DEBUG: ProtectionHandler: New code detected at (0x000B0000), scanning for PE images.
2020-01-14 13:36:03,956 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb13da.
2020-01-14 13:36:03,956 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb13da.
2020-01-14 13:36:03,971 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb13da.
2020-01-14 13:36:03,971 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb13da.
2020-01-14 13:36:03,971 [root] DEBUG: ProtectionHandler: Address 0x000B13E8 already in tracked region at 0x000B0000, size 0x13da
2020-01-14 13:36:03,971 [root] DEBUG: ProtectionHandler: Address: 0x000B13E8 (alloc base 0x000B0000), NumberOfBytesToProtect: 0xa, NewAccessProtection: 0x40
2020-01-14 13:36:03,971 [root] DEBUG: ProtectionHandler: Increased region size at 0x000B13E8 to 0x13f2.
2020-01-14 13:36:03,987 [root] DEBUG: ProtectionHandler: New code detected at (0x000B0000), scanning for PE images.
2020-01-14 13:36:03,987 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb13f2.
2020-01-14 13:36:03,987 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb13f2.
2020-01-14 13:36:03,987 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb13f2.
2020-01-14 13:36:03,987 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb13f2.
2020-01-14 13:36:03,987 [root] DEBUG: ProtectionHandler: Address 0x000B1400 already in tracked region at 0x000B0000, size 0x13f2
2020-01-14 13:36:03,987 [root] DEBUG: ProtectionHandler: Address: 0x000B1400 (alloc base 0x000B0000), NumberOfBytesToProtect: 0xa, NewAccessProtection: 0x40
2020-01-14 13:36:04,003 [root] DEBUG: ProtectionHandler: Increased region size at 0x000B1400 to 0x140a.
2020-01-14 13:36:04,003 [root] DEBUG: ProtectionHandler: New code detected at (0x000B0000), scanning for PE images.
2020-01-14 13:36:04,003 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb140a.
2020-01-14 13:36:04,003 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb140a.
2020-01-14 13:36:04,003 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb140a.
2020-01-14 13:36:04,003 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb140a.
2020-01-14 13:36:04,019 [root] DEBUG: DLL loaded at 0x74830000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks (0x5ab000 bytes).
2020-01-14 13:36:04,033 [root] DEBUG: DLL loaded at 0x74790000: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80 (0x9b000 bytes).
2020-01-14 13:36:04,033 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1152.
2020-01-14 13:36:04,033 [root] DEBUG: Allocation: 0x0009A000 - 0x0009B000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,033 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,033 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,049 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,049 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,049 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,049 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,049 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x0009A000, size: 0x1000.
2020-01-14 13:36:04,049 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x0009A000) returned 0x00000000.
2020-01-14 13:36:04,065 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:04,065 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x0009A000) -> AllocationBase 0x00090000 RegionSize 0x4096.
2020-01-14 13:36:04,065 [root] DEBUG: AddTrackedRegion: New region at 0x00090000 size 0x1000 added to tracked regions.
2020-01-14 13:36:04,096 [root] DEBUG: Allocation: 0x00092000 - 0x00093000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,096 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,096 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,111 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,111 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,111 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,111 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,111 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:04,128 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00090000, size: 0x1000.
2020-01-14 13:36:04,128 [root] DEBUG: DLL loaded at 0x74780000: C:\Windows\system32\profapi (0xb000 bytes).
2020-01-14 13:36:04,128 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2144.
2020-01-14 13:36:04,144 [root] DEBUG: DLL loaded at 0x734D0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni (0xaf8000 bytes).
2020-01-14 13:36:04,144 [root] DEBUG: Allocation: 0x000A2000 - 0x000A3000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,144 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,144 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,144 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,158 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,158 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,158 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,158 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:04,158 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x000A2000, size: 0x1000.
2020-01-14 13:36:04,158 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x000A2000) returned 0x00000000.
2020-01-14 13:36:04,174 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:04,174 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x000A2000) -> AllocationBase 0x000A0000 RegionSize 0x4096.
2020-01-14 13:36:04,174 [root] DEBUG: AddTrackedRegion: New region at 0x000A0000 size 0x1000 added to tracked regions.
2020-01-14 13:36:04,190 [root] DEBUG: DLL unloaded from 0x77390000.
2020-01-14 13:36:04,190 [root] DEBUG: set_caller_info: Adding region at 0x202F0000 to caller regions list (ntdll::NtAllocateVirtualMemory).
2020-01-14 13:36:04,190 [root] DEBUG: DLL loaded at 0x75630000: C:\Windows\system32\CRYPTSP (0x16000 bytes).
2020-01-14 13:36:04,206 [root] DEBUG: DLL loaded at 0x755F0000: C:\Windows\system32\rsaenh (0x3b000 bytes).
2020-01-14 13:36:04,206 [root] DEBUG: Allocation: 0x000A3000 - 0x000A4000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,206 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,206 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,206 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,221 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,221 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,221 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,221 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:04,221 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:04,236 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x000A0000, size: 0x1000.
2020-01-14 13:36:04,236 [root] DEBUG: Allocation: 0x0015B000 - 0x0015C000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,236 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,236 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,236 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,253 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,253 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,253 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,253 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:04,253 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:04,267 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x0015B000, size: 0x1000.
2020-01-14 13:36:04,267 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x0015B000) returned 0x00000000.
2020-01-14 13:36:04,267 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:04,283 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x0015B000) -> AllocationBase 0x00150000 RegionSize 0x4096.
2020-01-14 13:36:04,283 [root] DEBUG: AddTrackedRegion: New region at 0x00150000 size 0x1000 added to tracked regions.
2020-01-14 13:36:04,299 [root] DEBUG: Allocation: 0x00157000 - 0x00158000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,299 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,299 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,299 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,299 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,299 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,315 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,315 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:04,315 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:04,315 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:04,331 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00150000, size: 0x1000.
2020-01-14 13:36:04,331 [root] DEBUG: Allocation: 0x000A4000 - 0x000A7000, size: 0x3000, protection: 0x40.
2020-01-14 13:36:04,331 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,331 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,345 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,345 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,345 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,345 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,361 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:04,361 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:04,361 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:04,361 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x000A0000, size: 0x1000.
2020-01-14 13:36:04,408 [root] DEBUG: Allocation: 0x000AC000 - 0x000AD000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,408 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,408 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,408 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,408 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,424 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,424 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,424 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:04,424 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:04,424 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:04,424 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x000A0000, size: 0x1000.
2020-01-14 13:36:04,440 [root] DEBUG: DLL loaded at 0x74720000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit (0x5b000 bytes).
2020-01-14 13:36:04,924 [root] DEBUG: Allocation: 0x20490000 - 0x20491000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,938 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,938 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,938 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,938 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,938 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,954 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,954 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:04,954 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:04,954 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:04,954 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x20490000, size: 0x1000.
2020-01-14 13:36:04,954 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x20490000) returned 0x00000000.
2020-01-14 13:36:04,970 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:04,970 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x20490000) -> AllocationBase 0x20490000 RegionSize 0x4096.
2020-01-14 13:36:04,970 [root] DEBUG: AddTrackedRegion: New region at 0x20490000 size 0x1000 added to tracked regions.
2020-01-14 13:36:04,970 [root] DEBUG: Allocation: 0x226E0000 - 0x226E1000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:04,986 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:04,986 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:04,986 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:04,986 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:04,986 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:04,986 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:04,986 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:05,002 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:05,002 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:05,002 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:05,002 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:36:05,002 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x226E0000) returned 0x00000000.
2020-01-14 13:36:05,002 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:05,002 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x226E0000) -> AllocationBase 0x226E0000 RegionSize 0x4096.
2020-01-14 13:36:05,002 [root] DEBUG: AddTrackedRegion: New region at 0x226E0000 size 0x1000 added to tracked regions.
2020-01-14 13:36:05,016 [root] DEBUG: Allocation: 0x226E1000 - 0x226F3000, size: 0x12000, protection: 0x40.
2020-01-14 13:36:05,016 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:05,016 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:05,016 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:05,016 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:05,016 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:05,032 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:05,032 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:05,032 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:05,032 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:05,032 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:05,032 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:05,032 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:36:05,048 [root] DEBUG: set_caller_info: Adding region at 0x226E0000 to caller regions list (ntdll::NtQueryPerformanceCounter).
2020-01-14 13:36:05,048 [root] DEBUG: set_caller_info: Caller at 0x226E0098 in tracked regions.
2020-01-14 13:36:05,063 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:05,063 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:05,063 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:05,079 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:05,095 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:05,095 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:05,095 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:05,095 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:05,095 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:05,095 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:05,095 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:05,111 [root] DEBUG: DumpPEsInRange: Scanning range 0x226e0000 - 0x226e1000.
2020-01-14 13:36:05,111 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x226e0000-0x226e1000.
2020-01-14 13:36:05,111 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x226E0000 - 0x226E1000.
2020-01-14 13:36:05,111 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_10502495805162114212020 successfully created, size 0x20000
2020-01-14 13:36:05,111 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x3ff2e in capemon caught accessing 0x226f3000 (expected in memory scans), passing to next handler.
2020-01-14 13:36:05,111 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x226e0000
2020-01-14 13:36:05,111 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x226E0000 size 0x20000.
2020-01-14 13:36:05,125 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_6244641365162114212020 successfully created, size 0x13000
2020-01-14 13:36:05,125 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_6244641365162114212020
2020-01-14 13:36:05,141 [root] DEBUG: DumpRegion: Dumped stack region from 0x226E0000, size 0x13000.
2020-01-14 13:36:05,141 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x226E0000.
2020-01-14 13:36:05,141 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x226e0000 - 0x226e1000.
2020-01-14 13:36:05,298 [root] DEBUG: set_caller_info: Adding region at 0x00090000 to caller regions list (ntdll::LdrGetProcedureAddress).
2020-01-14 13:36:05,298 [root] DEBUG: set_caller_info: Caller at 0x00092420 in tracked regions.
2020-01-14 13:36:05,298 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:05,298 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:05,298 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:05,298 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:05,313 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:05,313 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:05,313 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:05,313 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1a50 in capemon caught accessing 0x90000 (expected in memory scans), passing to next handler.
2020-01-14 13:36:05,313 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:05,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:05,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:05,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:05,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:05,562 [root] DEBUG: Allocation: 0x000A7000 - 0x000A8000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:05,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:05,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:05,578 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:05,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:05,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:05,594 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:05,594 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:05,594 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:05,594 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:05,594 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:05,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:05,609 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:05,625 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x000A0000, size: 0x1000.
2020-01-14 13:36:05,625 [root] DEBUG: DLL loaded at 0x72D30000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni (0x79c000 bytes).
2020-01-14 13:36:05,641 [root] DEBUG: DLL loaded at 0x74590000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni (0x188000 bytes).
2020-01-14 13:36:05,641 [root] DEBUG: Allocation: 0x000A8000 - 0x000A9000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:05,641 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:05,641 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:05,641 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:05,641 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:05,657 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:05,657 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:05,657 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:05,671 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:05,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:05,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:05,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:05,703 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:05,703 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x000A0000, size: 0x1000.
2020-01-14 13:36:05,719 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:05,719 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:05,719 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:05,719 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:05,719 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:05,719 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:05,719 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:05,719 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:05,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:05,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:05,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:05,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:05,734 [root] DEBUG: ProtectionHandler: Adding region at 0x228AF000 to tracked regions.
2020-01-14 13:36:05,734 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x228AF000) returned 0x00000000.
2020-01-14 13:36:05,734 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:05,734 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x228AF000) -> AllocationBase 0x22700000 RegionSize 0x10268672.
2020-01-14 13:36:05,750 [root] DEBUG: AddTrackedRegion: New region at 0x22700000 size 0x9cb000 added to tracked regions.
2020-01-14 13:36:05,750 [root] DEBUG: ProtectionHandler: Address: 0x228AF000 (alloc base 0x22700000), NumberOfBytesToProtect: 0x9cb000, NewAccessProtection: 0x40
2020-01-14 13:36:05,750 [root] DEBUG: ProtectionHandler: Increased region size at 0x228AF000 to 0xb7a000.
2020-01-14 13:36:05,750 [root] DEBUG: ProtectionHandler: New code detected at (0x22700000), scanning for PE images.
2020-01-14 13:36:05,750 [root] DEBUG: DumpPEsInRange: Scanning range 0x22700000 - 0x2327a000.
2020-01-14 13:36:05,750 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x22700000
2020-01-14 13:36:05,782 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:05,796 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x22700000.
2020-01-14 13:36:05,796 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000.
2020-01-14 13:36:12,880 [lib.common.results] ERROR: Exception uploading file C:\xObftrX\CAPE\2612_141993643612361314212020 to host: [Errno 10053] An established connection was aborted by the software in your host machine
2020-01-14 13:36:12,880 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_141993643612361314212020
2020-01-14 13:36:12,894 [root] DEBUG: DumpProcess: Module image dump success - dump size 0xb78a00.
2020-01-14 13:36:12,926 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2816, RVA 0xce000400 and size 0x22d.
2020-01-14 13:36:12,926 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x22cc5fcf
2020-01-14 13:36:12,941 [root] DEBUG: DumpImageInCurrentProcess: Disguised PE image (bad MZ and/or PE headers) at 0x22CC5FCF
2020-01-14 13:36:12,941 [root] DEBUG: getSectionHeaders: Exception copying section header at 0x234A03A0.
2020-01-14 13:36:12,941 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:12,941 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x22CC5FCF.
2020-01-14 13:36:12,957 [root] DEBUG: getSectionHeaders: Exception copying section header at 0x234A03A0.
2020-01-14 13:36:12,957 [root] DEBUG: DumpProcess: Error - entry point too big: 0x91dd0d17, ignoring.
2020-01-14 13:36:12,973 [root] DEBUG: reBasePEImage: Error, invalid image base 0x22CC5FCF.
2020-01-14 13:36:12,989 [root] DEBUG: readPeSectionsFromProcess: Failed to relocate image back to header image base 0x6F03020C.
2020-01-14 13:36:13,003 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 3 of 44328, RVA 0xa000097 and size 0x7306147a.
2020-01-14 13:36:13,003 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 1043, RVA 0x3060047 and size 0x5280511.
2020-01-14 13:36:13,003 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2833, RVA 0x28160219 and size 0x60015bb.
2020-01-14 13:36:13,003 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2833, RVA 0x28160219 and size 0x60015bb.
2020-01-14 13:36:13,051 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x22cc61cf-0x2327a000.
2020-01-14 13:36:13,066 [root] DEBUG: ProtectionHandler: PE image(s) dumped from 0x22700000.
2020-01-14 13:36:13,082 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x22700000 - 0x2327a000.
2020-01-14 13:36:13,098 [root] DEBUG: ProtectionHandler: Address 0x2327A000 already in tracked region at 0x22700000, size 0xb7a000
2020-01-14 13:36:13,128 [root] DEBUG: ProtectionHandler: Address: 0x2327A000 (alloc base 0x22700000), NumberOfBytesToProtect: 0x1000, NewAccessProtection: 0x40
2020-01-14 13:36:13,144 [root] DEBUG: ProtectionHandler: Increased region size at 0x2327A000 to 0xb7b000.
2020-01-14 13:36:13,144 [root] DEBUG: ProtectionHandler: New code detected at (0x22700000), scanning for PE images.
2020-01-14 13:36:13,144 [root] DEBUG: DumpPEsInRange: Scanning range 0x22700000 - 0x2327b000.
2020-01-14 13:36:13,144 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x22700000
2020-01-14 13:36:13,160 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:13,160 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x22700000.
2020-01-14 13:36:13,160 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000.
2020-01-14 13:36:13,440 [lib.common.results] ERROR: Exception uploading file C:\xObftrX\CAPE\2612_135171403213361314212020 to host: [Errno 10054] An existing connection was forcibly closed by the remote host
2020-01-14 13:36:13,457 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_135171403213361314212020
2020-01-14 13:36:13,457 [root] DEBUG: DumpProcess: Module image dump success - dump size 0xb78a00.
2020-01-14 13:36:13,503 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2816, RVA 0xce000400 and size 0x22d.
2020-01-14 13:36:13,519 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x22cc5fcf
2020-01-14 13:36:13,535 [root] DEBUG: DumpImageInCurrentProcess: Disguised PE image (bad MZ and/or PE headers) at 0x22CC5FCF
2020-01-14 13:36:13,535 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:13,549 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x22CC5FCF.
2020-01-14 13:36:13,549 [root] DEBUG: DumpProcess: Error - entry point too big: 0x91dd0d17, ignoring.
2020-01-14 13:36:13,549 [root] DEBUG: reBasePEImage: Error, invalid image base 0x22CC5FCF.
2020-01-14 13:36:13,565 [root] DEBUG: readPeSectionsFromProcess: Failed to relocate image back to header image base 0x6F03020C.
2020-01-14 13:36:13,565 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 3 of 44328, RVA 0xa000097 and size 0x7306147a.
2020-01-14 13:36:13,565 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 1043, RVA 0x3060047 and size 0x5280511.
2020-01-14 13:36:13,582 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2833, RVA 0x28160219 and size 0x60015bb.
2020-01-14 13:36:13,582 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2833, RVA 0x28160219 and size 0x60015bb.
2020-01-14 13:36:13,612 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x22cc61cf-0x2327b000.
2020-01-14 13:36:13,612 [root] DEBUG: ProtectionHandler: PE image(s) dumped from 0x22700000.
2020-01-14 13:36:13,612 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x22700000 - 0x2327b000.
2020-01-14 13:36:13,628 [root] DEBUG: ProtectionHandler: Address 0x2327B000 already in tracked region at 0x22700000, size 0xb7b000
2020-01-14 13:36:13,628 [root] DEBUG: ProtectionHandler: Address: 0x2327B000 (alloc base 0x22700000), NumberOfBytesToProtect: 0x63000, NewAccessProtection: 0x40
2020-01-14 13:36:13,628 [root] DEBUG: ProtectionHandler: Increased region size at 0x2327B000 to 0xbde000.
2020-01-14 13:36:13,644 [root] DEBUG: ProtectionHandler: New code detected at (0x22700000), scanning for PE images.
2020-01-14 13:36:13,644 [root] DEBUG: DumpPEsInRange: Scanning range 0x22700000 - 0x232de000.
2020-01-14 13:36:13,644 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x22700000
2020-01-14 13:36:13,644 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:13,644 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x22700000.
2020-01-14 13:36:13,644 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000.
2020-01-14 13:36:13,846 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_72360303113361314212020
2020-01-14 13:36:13,846 [root] DEBUG: DumpProcess: Module image dump success - dump size 0xb78a00.
2020-01-14 13:36:13,908 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2816, RVA 0xce000400 and size 0x22d.
2020-01-14 13:36:13,940 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x22cc5fcf
2020-01-14 13:36:13,956 [root] DEBUG: DumpImageInCurrentProcess: Disguised PE image (bad MZ and/or PE headers) at 0x22CC5FCF
2020-01-14 13:36:13,956 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:13,971 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x22CC5FCF.
2020-01-14 13:36:13,986 [root] DEBUG: DumpProcess: Error - entry point too big: 0x91dd0d17, ignoring.
2020-01-14 13:36:14,003 [root] DEBUG: reBasePEImage: Error, invalid image base 0x22CC5FCF.
2020-01-14 13:36:14,017 [root] DEBUG: readPeSectionsFromProcess: Failed to relocate image back to header image base 0x6F03020C.
2020-01-14 13:36:14,033 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 3 of 44328, RVA 0xa000097 and size 0x7306147a.
2020-01-14 13:36:14,033 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 1043, RVA 0x3060047 and size 0x5280511.
2020-01-14 13:36:14,049 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2833, RVA 0x28160219 and size 0x60015bb.
2020-01-14 13:36:14,065 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2833, RVA 0x28160219 and size 0x60015bb.
2020-01-14 13:36:14,128 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x22cc61cf-0x232de000.
2020-01-14 13:36:14,142 [root] DEBUG: ProtectionHandler: PE image(s) dumped from 0x22700000.
2020-01-14 13:36:14,174 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x22700000 - 0x232de000.
2020-01-14 13:36:14,190 [root] DEBUG: ProtectionHandler: Address 0x228AF000 already in tracked region at 0x22700000, size 0xbde000
2020-01-14 13:36:14,190 [root] DEBUG: ProtectionHandler: Address: 0x228AF000 (alloc base 0x22700000), NumberOfBytesToProtect: 0x9cb000, NewAccessProtection: 0x20
2020-01-14 13:36:14,206 [root] DEBUG: ProtectionHandler: Updated region protection at 0x228AF000 to 0x20.
2020-01-14 13:36:14,206 [root] DEBUG: ProtectionHandler: New code detected at (0x22700000), scanning for PE images.
2020-01-14 13:36:14,206 [root] DEBUG: DumpPEsInRange: Scanning range 0x22700000 - 0x232de000.
2020-01-14 13:36:14,206 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x22700000
2020-01-14 13:36:14,206 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:14,206 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x22700000.
2020-01-14 13:36:14,206 [root] DEBUG: DumpProcess: Module entry point VA is 0x00000000.
2020-01-14 13:36:14,407 [lib.common.results] ERROR: Exception uploading file C:\xObftrX\CAPE\2612_162814240614361314212020 to host: [Errno 10053] An established connection was aborted by the software in your host machine
2020-01-14 13:36:14,407 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_162814240614361314212020
2020-01-14 13:36:14,424 [root] DEBUG: DumpProcess: Module image dump success - dump size 0xb78a00.
2020-01-14 13:36:14,454 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2816, RVA 0xce000400 and size 0x22d.
2020-01-14 13:36:14,502 [root] DEBUG: ScanForDisguisedPE: PE image located at: 0x22cc5fcf
2020-01-14 13:36:14,517 [root] DEBUG: DumpImageInCurrentProcess: Disguised PE image (bad MZ and/or PE headers) at 0x22CC5FCF
2020-01-14 13:36:14,517 [root] DEBUG: DumpImageInCurrentProcess: Attempting to dump virtual PE image.
2020-01-14 13:36:14,517 [root] DEBUG: DumpProcess: Instantiating PeParser with address: 0x22CC5FCF.
2020-01-14 13:36:14,549 [root] DEBUG: DumpProcess: Error - entry point too big: 0x91dd0d17, ignoring.
2020-01-14 13:36:14,549 [root] DEBUG: reBasePEImage: Error, invalid image base 0x22CC5FCF.
2020-01-14 13:36:14,549 [root] DEBUG: readPeSectionsFromProcess: Failed to relocate image back to header image base 0x6F03020C.
2020-01-14 13:36:14,563 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 3 of 44328, RVA 0xa000097 and size 0x7306147a.
2020-01-14 13:36:14,563 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 1043, RVA 0x3060047 and size 0x5280511.
2020-01-14 13:36:14,579 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2833, RVA 0x28160219 and size 0x60015bb.
2020-01-14 13:36:14,579 [root] DEBUG: TestPERequirements: Possible PE image rejected due to section 1 of 2833, RVA 0x28160219 and size 0x60015bb.
2020-01-14 13:36:14,641 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x22cc61cf-0x232de000.
2020-01-14 13:36:14,657 [root] DEBUG: ProtectionHandler: PE image(s) dumped from 0x22700000.
2020-01-14 13:36:14,674 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x22700000 - 0x232de000.
2020-01-14 13:36:14,752 [root] DEBUG: DLL loaded at 0x22700000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni (0xbde000 bytes).
2020-01-14 13:36:14,782 [root] DEBUG: Allocation: 0x003E0000 - 0x003E2000, size: 0x2000, protection: 0x40.
2020-01-14 13:36:14,798 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:14,798 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:14,798 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:14,813 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:14,813 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:14,813 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:14,829 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:14,829 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:14,829 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:14,845 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:14,845 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:14,845 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:14,845 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:14,861 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x003E0000, size: 0x2000.
2020-01-14 13:36:14,875 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 11.
2020-01-14 13:36:14,891 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x003E0000) returned 0x00000000.
2020-01-14 13:36:14,891 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:14,907 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x003E0000) -> AllocationBase 0x003E0000 RegionSize 0x8192.
2020-01-14 13:36:14,907 [root] DEBUG: AddTrackedRegion: New region at 0x003E0000 size 0x2000 added to tracked regions.
2020-01-14 13:36:14,923 [root] DEBUG: ActivateBreakpoints: TrackedRegion->AllocationBase: 0x003E0000, TrackedRegion->RegionSize: 0x2000, thread 2712
2020-01-14 13:36:14,923 [root] DEBUG: ActivateBreakpoints: Switching breakpoints from region 0x00300000 to 0x003E0000.
2020-01-14 13:36:14,923 [root] DEBUG: ClearAllBreakpoints: Error getting thread context for thread 2616.
2020-01-14 13:36:14,923 [root] DEBUG: ClearAllBreakpoints: Error getting thread context for thread 2616.
2020-01-14 13:36:14,938 [root] DEBUG: SetDebugRegister: Setting breakpoint 0 hThread=0xfc, Size=0x2, Address=0x003E0000 and Type=0x1.
2020-01-14 13:36:14,938 [root] DEBUG: SetThreadBreakpoint: Set bp 0 thread id 2712 type 1 at address 0x003E0000, size 2 with Callback 0x74eb7510.
2020-01-14 13:36:14,938 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on empty protect address: 0x003E0000
2020-01-14 13:36:14,953 [root] DEBUG: SetDebugRegister: Setting breakpoint 1 hThread=0xfc, Size=0x4, Address=0x003E003C and Type=0x1.
2020-01-14 13:36:14,953 [root] DEBUG: SetThreadBreakpoint: Set bp 1 thread id 2712 type 1 at address 0x003E003C, size 4 with Callback 0x74eb71a0.
2020-01-14 13:36:14,970 [root] DEBUG: ActivateBreakpoints: Set write breakpoint on e_lfanew address: 0x003E003C
2020-01-14 13:36:14,970 [root] DEBUG: AllocationHandler: Breakpoints set on newly-allocated executable region at: 0x003E0000 (size 0x2000).
2020-01-14 13:36:14,970 [root] DEBUG: DLL unloaded from 0x77B20000.
2020-01-14 13:36:14,970 [root] DEBUG: CAPEExceptionFilter: breakpoint hit by instruction at 0x748712E1 (thread 2712)
2020-01-14 13:36:14,986 [root] DEBUG: BaseAddressWriteCallback: Breakpoint 0 at Address 0x003E0000.
2020-01-14 13:36:14,986 [root] DEBUG: ContextSetDebugRegister: Setting breakpoint 2 within Context, Size=0x0, Address=0x003E0000 and Type=0x0.
2020-01-14 13:36:14,986 [root] DEBUG: BaseAddressWriteCallback: byte written to 0x3e0000: 0x0.
2020-01-14 13:36:15,000 [root] DEBUG: BaseAddressWriteCallback: Exec bp set on tracked region protect address.
2020-01-14 13:36:15,220 [root] DEBUG: Allocation: 0x0014A000 - 0x0014B000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:15,220 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:15,220 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:15,250 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:15,250 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:15,282 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:15,298 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:15,298 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:15,298 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:15,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:15,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:15,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:15,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:15,344 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:15,344 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:15,344 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x0014A000, size: 0x1000.
2020-01-14 13:36:15,359 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 12.
2020-01-14 13:36:15,359 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x0014A000) returned 0x00000000.
2020-01-14 13:36:15,359 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:15,359 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x0014A000) -> AllocationBase 0x00140000 RegionSize 0x4096.
2020-01-14 13:36:15,375 [root] DEBUG: AddTrackedRegion: New region at 0x00140000 size 0x1000 added to tracked regions.
2020-01-14 13:36:15,453 [root] DEBUG: Allocation: 0x00142000 - 0x00143000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:15,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:15,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:15,469 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:15,484 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:15,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:15,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:15,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:15,500 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:15,516 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:15,532 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:15,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:15,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:15,594 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:15,594 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:15,594 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:15,609 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00140000, size: 0x1000.
2020-01-14 13:36:16,217 [root] DEBUG: Allocation: 0x226F3000 - 0x226F6000, size: 0x3000, protection: 0x40.
2020-01-14 13:36:16,265 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:16,279 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:16,279 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:16,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:16,326 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:16,326 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:16,342 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:16,342 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:16,342 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:16,342 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:16,358 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:16,358 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:16,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:16,390 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:16,404 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:16,404 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:36:16,795 [root] DEBUG: DLL loaded at 0x74570000: C:\Windows\system32\bcrypt (0x17000 bytes).
2020-01-14 13:36:16,997 [root] DEBUG: Allocation: 0x226F6000 - 0x226F7000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:17,059 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:17,138 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:17,170 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:17,184 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:17,200 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:17,200 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:17,216 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:17,279 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:17,279 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:17,309 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:17,325 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:17,325 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:17,325 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:17,325 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:17,341 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:17,341 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:36:17,404 [root] DEBUG: Allocation: 0x00136000 - 0x00137000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:17,450 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:17,466 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:17,482 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:17,528 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:17,528 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:17,543 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:17,543 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:17,543 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:17,559 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:17,559 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:17,559 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:17,559 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:17,575 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:17,575 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:17,575 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:17,591 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x00136000, size: 0x1000.
2020-01-14 13:36:17,591 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 13.
2020-01-14 13:36:17,591 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00136000) returned 0x00000000.
2020-01-14 13:36:17,605 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:17,605 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00136000) -> AllocationBase 0x00130000 RegionSize 0x4096.
2020-01-14 13:36:17,621 [root] DEBUG: AddTrackedRegion: New region at 0x00130000 size 0x1000 added to tracked regions.
2020-01-14 13:36:17,700 [root] DEBUG: Allocation: 0x0013A000 - 0x0013B000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:17,716 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:17,716 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:17,716 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:17,716 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:17,730 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:17,746 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:17,746 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:17,762 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:17,762 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:17,762 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:17,762 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:17,762 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:17,762 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:17,778 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:17,778 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:17,778 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:17,778 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00130000, size: 0x1000.
2020-01-14 13:36:17,793 [root] DEBUG: Allocation: 0x00137000 - 0x00138000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:17,793 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:17,793 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:17,809 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:17,809 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:17,809 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:17,809 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:17,809 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:17,825 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:17,825 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:17,825 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:17,825 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:17,839 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:17,839 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:17,839 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:17,839 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:17,855 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:17,855 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00130000, size: 0x1000.
2020-01-14 13:36:17,887 [root] DEBUG: Allocation: 0x003E2000 - 0x003E3000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:17,887 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:17,903 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:17,903 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:17,934 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:17,934 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:17,934 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:17,950 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:17,950 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:17,964 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:17,980 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:18,028 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:18,042 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:18,042 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:18,059 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:18,059 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:18,059 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:18,059 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003E0000, size: 0x2000.
2020-01-14 13:36:18,121 [root] DEBUG: Allocation: 0x202F1000 - 0x202F2000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:18,121 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:18,137 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:18,137 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:18,151 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:18,167 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:18,198 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:18,214 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:18,262 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:18,308 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:18,323 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:18,355 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:18,355 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:18,355 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:18,371 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:18,401 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:18,401 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:18,480 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x202F1000, size: 0x1000.
2020-01-14 13:36:18,480 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 14.
2020-01-14 13:36:18,480 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x202F1000) returned 0x00000000.
2020-01-14 13:36:18,510 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:18,542 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x202F1000) -> AllocationBase 0x202F0000 RegionSize 0x4096.
2020-01-14 13:36:18,542 [root] DEBUG: AddTrackedRegion: New region at 0x202F0000 size 0x1000 added to tracked regions.
2020-01-14 13:36:18,651 [root] DEBUG: DLL loaded at 0x743D0000: C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni (0x19b000 bytes).
2020-01-14 13:36:18,901 [root] DEBUG: Allocation: 0x226F7000 - 0x226F8000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:18,917 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:18,947 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:18,979 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:18,979 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:19,009 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:19,009 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:19,026 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:19,056 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:19,072 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:19,072 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:19,134 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:19,181 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:19,338 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:19,354 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:19,447 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:19,463 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:19,477 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:19,477 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:36:19,588 [root] DEBUG: DLL loaded at 0x743C0000: C:\Windows\system32\RpcRtRemote (0xe000 bytes).
2020-01-14 13:36:19,602 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2140.
2020-01-14 13:36:19,602 [root] DEBUG: Allocation: 0x0009B000 - 0x0009C000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:19,602 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:19,618 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:19,618 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:19,634 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:19,634 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:19,650 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:19,665 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:19,665 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:19,680 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:19,743 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:19,789 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:19,789 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:19,805 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:19,822 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:19,822 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:19,836 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:19,836 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:19,852 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00090000, size: 0x1000.
2020-01-14 13:36:19,852 [root] DEBUG: DLL loaded at 0x77160000: C:\Windows\syswow64\CLBCatQ (0x83000 bytes).
2020-01-14 13:36:19,914 [root] DEBUG: DLL loaded at 0x74380000: C:\Windows\system32\wbem\wbemdisp (0x31000 bytes).
2020-01-14 13:36:20,164 [root] DEBUG: DLL loaded at 0x74320000: C:\Windows\system32\wbemcomn (0x5c000 bytes).
2020-01-14 13:36:20,257 [root] DEBUG: DLL loaded at 0x75A60000: C:\Windows\syswow64\WS2_32 (0x35000 bytes).
2020-01-14 13:36:20,257 [root] DEBUG: DLL loaded at 0x76EF0000: C:\Windows\syswow64\NSI (0x6000 bytes).
2020-01-14 13:36:30,039 [root] INFO: Stopped WMI Service
2020-01-14 13:36:30,039 [root] INFO: Attaching to DcomLaunch service (pid 572)
2020-01-14 13:36:30,148 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:36:30,148 [lib.api.process] INFO: 64-bit DLL to inject is C:\mmwcpkjad\dll\vRlBbyA.dll, loader C:\mmwcpkjad\bin\otGOKhGg.exe
2020-01-14 13:36:30,335 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:36:30,351 [root] DEBUG: Loader: Injecting process 572 (thread 0) with C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:30,351 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 576, handle 0x84
2020-01-14 13:36:30,367 [root] DEBUG: Process image base: 0x00000000FFB40000
2020-01-14 13:36:30,617 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-01-14 13:36:30,898 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-01-14 13:36:30,944 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:36:30,960 [root] DEBUG: Process dumps disabled.
2020-01-14 13:36:30,976 [root] INFO: Disabling sleep skipping.
2020-01-14 13:36:31,552 [root] WARNING: Unable to place hook on LockResource
2020-01-14 13:36:31,599 [root] WARNING: Unable to hook LockResource
2020-01-14 13:36:31,880 [root] DEBUG: Debugger initialised.
2020-01-14 13:36:31,895 [root] DEBUG: CAPE initialised: 64-bit Extraction package loaded in process 572 at 0x0000000074130000, image base 0x00000000FFB40000, stack from 0x0000000001906000-0x0000000001910000
2020-01-14 13:36:31,895 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k DcomLaunch.
2020-01-14 13:36:31,911 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00000000FFB40000) returned 0x0000000000000000.
2020-01-14 13:36:31,911 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x0000000000000000.
2020-01-14 13:36:31,927 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00000000FFB40000) -> AllocationBase 0x00000000FFB40000 RegionSize 0x4096.
2020-01-14 13:36:31,973 [root] DEBUG: AddTrackedRegion: EntryPoint 0x246c, Entropy 3.674646e+00
2020-01-14 13:36:31,973 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FFB40000 size 0x1000 added to tracked regions.
2020-01-14 13:36:31,973 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:36:31,990 [root] INFO: Added new process to list with pid: 572
2020-01-14 13:36:32,005 [root] INFO: Monitor successfully loaded in process with pid 572.
2020-01-14 13:36:32,223 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-01-14 13:36:32,316 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-01-14 13:36:32,394 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:36,716 [root] INFO: Started WMI Service
2020-01-14 13:36:36,732 [root] INFO: Attaching to WMI service (pid 2256)
2020-01-14 13:36:36,779 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:36:36,779 [lib.api.process] INFO: 64-bit DLL to inject is C:\mmwcpkjad\dll\vRlBbyA.dll, loader C:\mmwcpkjad\bin\otGOKhGg.exe
2020-01-14 13:36:36,793 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:36:36,793 [root] DEBUG: Loader: Injecting process 2256 (thread 0) with C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:36,809 [root] DEBUG: InjectDll: No thread ID supplied. Initial thread ID 2588, handle 0x84
2020-01-14 13:36:36,809 [root] DEBUG: Process image base: 0x00000000FFB40000
2020-01-14 13:36:36,809 [root] DEBUG: InjectDllViaIAT: Not a new process, aborting IAT patch
2020-01-14 13:36:36,904 [root] DEBUG: InjectDll: IAT patching failed, falling back to thread injection.
2020-01-14 13:36:36,934 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:36:36,982 [root] DEBUG: Process dumps disabled.
2020-01-14 13:36:36,996 [root] INFO: Disabling sleep skipping.
2020-01-14 13:36:37,013 [root] WARNING: Unable to place hook on LockResource
2020-01-14 13:36:37,013 [root] WARNING: Unable to hook LockResource
2020-01-14 13:36:37,028 [root] DEBUG: Debugger initialised.
2020-01-14 13:36:37,091 [root] DEBUG: CAPE initialised: 64-bit Extraction package loaded in process 2256 at 0x0000000074130000, image base 0x00000000FFB40000, stack from 0x0000000001305000-0x0000000001310000
2020-01-14 13:36:37,138 [root] DEBUG: Commandline: C:\Windows\sysnative\svchost.exe -k netsvcs.
2020-01-14 13:36:37,138 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00000000FFB40000) returned 0x0000000000000000.
2020-01-14 13:36:37,153 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x0000000000000000.
2020-01-14 13:36:37,153 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00000000FFB40000) -> AllocationBase 0x00000000FFB40000 RegionSize 0x4096.
2020-01-14 13:36:37,168 [root] DEBUG: AddTrackedRegion: EntryPoint 0x246c, Entropy 3.661437e+00
2020-01-14 13:36:37,184 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FFB40000 size 0x1000 added to tracked regions.
2020-01-14 13:36:37,200 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:36:37,200 [root] INFO: Added new process to list with pid: 2256
2020-01-14 13:36:37,230 [root] INFO: Monitor successfully loaded in process with pid 2256.
2020-01-14 13:36:37,309 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-01-14 13:36:37,403 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-01-14 13:36:37,559 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:39,680 [root] DEBUG: DLL unloaded from 0x77390000.
2020-01-14 13:36:39,789 [root] DEBUG: DLL loaded at 0x74310000: C:\Windows\system32\wbem\wbemprox (0xa000 bytes).
2020-01-14 13:36:40,007 [root] DEBUG: DLL loaded at 0x742F0000: C:\Windows\system32\wbem\wmiutils (0x17000 bytes).
2020-01-14 13:36:40,148 [root] DEBUG: DLL loaded at 0x000007FEFA9B0000: C:\Windows\system32\VSSAPI (0x1b0000 bytes).
2020-01-14 13:36:40,180 [root] DEBUG: DLL loaded at 0x000007FEFB970000: C:\Windows\system32\ATL (0x19000 bytes).
2020-01-14 13:36:40,194 [root] DEBUG: DLL loaded at 0x000007FEFA840000: C:\Windows\system32\VssTrace (0x17000 bytes).
2020-01-14 13:36:40,242 [root] DEBUG: DLL loaded at 0x000007FEFB0A0000: C:\Windows\system32\samcli (0x14000 bytes).
2020-01-14 13:36:40,273 [root] DEBUG: DLL loaded at 0x000007FEFC050000: C:\Windows\system32\SAMLIB (0x1d000 bytes).
2020-01-14 13:36:40,381 [root] DEBUG: DLL loaded at 0x000007FEFB320000: C:\Windows\system32\netutils (0xc000 bytes).
2020-01-14 13:36:40,414 [root] DEBUG: DLL loaded at 0x000007FEFB860000: C:\Windows\system32\es (0x67000 bytes).
2020-01-14 13:36:40,476 [root] DEBUG: DLL loaded at 0x000007FEFC0A0000: C:\Windows\system32\PROPSYS (0x12c000 bytes).
2020-01-14 13:36:40,553 [root] DEBUG: DLL loaded at 0x000007FEFA010000: C:\Windows\system32\wbem\wbemcore (0x12f000 bytes).
2020-01-14 13:36:40,553 [root] DEBUG: DLL loaded at 0x000007FEF9FA0000: C:\Windows\system32\wbem\esscli (0x6f000 bytes).
2020-01-14 13:36:40,569 [root] DEBUG: DLL loaded at 0x000007FEFA350000: C:\Windows\system32\wbem\FastProx (0xe2000 bytes).
2020-01-14 13:36:40,601 [root] DEBUG: DLL loaded at 0x000007FEFA2A0000: C:\Windows\system32\NTDSAPI (0x27000 bytes).
2020-01-14 13:36:40,631 [root] DEBUG: DLL unloaded from 0x000007FEFA010000.
2020-01-14 13:36:40,648 [root] DEBUG: DLL loaded at 0x000007FEF9C80000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2020-01-14 13:36:40,740 [root] DEBUG: DLL loaded at 0x742D0000: C:\Windows\system32\wbem\wbemsvc (0xf000 bytes).
2020-01-14 13:36:40,849 [root] DEBUG: DLL loaded at 0x74090000: C:\Windows\system32\wbem\fastprox (0x96000 bytes).
2020-01-14 13:36:40,865 [root] DEBUG: DLL loaded at 0x72130000: C:\Windows\system32\NTDSAPI (0x18000 bytes).
2020-01-14 13:36:40,897 [root] DEBUG: DLL loaded at 0x000007FEFD2F0000: C:\Windows\system32\authZ (0x2f000 bytes).
2020-01-14 13:36:40,944 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1940.
2020-01-14 13:36:40,960 [root] DEBUG: DLL unloaded from 0x0000000077940000.
2020-01-14 13:36:41,006 [root] DEBUG: DLL loaded at 0x000007FEFAB80000: C:\Windows\system32\wbem\wmiutils (0x26000 bytes).
2020-01-14 13:36:41,038 [root] DEBUG: DLL loaded at 0x000007FEF9A30000: C:\Windows\system32\wbem\repdrvfs (0x73000 bytes).
2020-01-14 13:36:41,052 [root] WARNING: File at path "C:\Windows\sysnative\wbem\repository\WRITABLE.TST" does not exist, skip.
2020-01-14 13:36:41,099 [root] DEBUG: DLL loaded at 0x000007FEFD330000: C:\Windows\system32\Wevtapi (0x6d000 bytes).
2020-01-14 13:36:41,131 [root] DEBUG: DLL unloaded from 0x000007FEFD330000.
2020-01-14 13:36:41,473 [root] DEBUG: DLL loaded at 0x000007FEF8B80000: C:\Windows\system32\wbem\wmiprvsd (0xbc000 bytes).
2020-01-14 13:36:41,490 [root] DEBUG: DLL loaded at 0x000007FEF90A0000: C:\Windows\system32\NCObjAPI (0x16000 bytes).
2020-01-14 13:36:41,584 [root] DEBUG: DLL loaded at 0x000007FEF4E80000: C:\Windows\system32\wbem\wbemess (0x7e000 bytes).
2020-01-14 13:36:41,598 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2936.
2020-01-14 13:36:41,615 [root] DEBUG: DLL unloaded from 0x0000000077940000.
2020-01-14 13:36:41,755 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1040.
2020-01-14 13:36:41,786 [root] DEBUG: DLL unloaded from 0x0000000077720000.
2020-01-14 13:36:41,802 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2420.
2020-01-14 13:36:41,818 [root] DEBUG: DLL unloaded from 0x0000000077940000.
2020-01-14 13:36:41,864 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2532.
2020-01-14 13:36:41,864 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1472.
2020-01-14 13:36:41,864 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2080.
2020-01-14 13:36:41,880 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1124.
2020-01-14 13:36:41,895 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1648.
2020-01-14 13:36:41,927 [root] DEBUG: CreateThread: Initialising breakpoints for thread 556.
2020-01-14 13:36:41,941 [root] DEBUG: DLL loaded at 0x720D0000: C:\Windows\system32\SXS (0x5f000 bytes).
2020-01-14 13:36:42,005 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2504.
2020-01-14 13:36:42,114 [root] DEBUG: DLL loaded at 0x72090000: C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\CustomMarshalers.ni (0x3a000 bytes).
2020-01-14 13:36:42,144 [root] DEBUG: DLL loaded at 0x60350000: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers (0x15000 bytes).
2020-01-14 13:36:42,176 [root] DEBUG: Allocation: 0x202E0000 - 0x202E1000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:42,176 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:42,207 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:42,269 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:42,301 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:42,301 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:42,316 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:42,364 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:42,378 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:42,394 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:42,410 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:42,410 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 2152
2020-01-14 13:36:42,457 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:42,473 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:36:42,473 [lib.api.process] INFO: 64-bit DLL to inject is C:\mmwcpkjad\dll\vRlBbyA.dll, loader C:\mmwcpkjad\bin\otGOKhGg.exe
2020-01-14 13:36:42,473 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:42,473 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:36:42,473 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:42,473 [root] DEBUG: Loader: Injecting process 2152 (thread 1252) with C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:42,519 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:42,551 [root] DEBUG: Process image base: 0x00000000FF930000
2020-01-14 13:36:42,551 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:42,551 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:42,551 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:42,551 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-01-14 13:36:42,551 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:42,582 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:42,582 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x202E0000, size: 0x1000.
2020-01-14 13:36:42,582 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2152
2020-01-14 13:36:42,598 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 15.
2020-01-14 13:36:42,598 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 2152
2020-01-14 13:36:42,598 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x202E0000) returned 0x00000000.
2020-01-14 13:36:42,612 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:36:42,612 [lib.api.process] INFO: 64-bit DLL to inject is C:\mmwcpkjad\dll\vRlBbyA.dll, loader C:\mmwcpkjad\bin\otGOKhGg.exe
2020-01-14 13:36:42,612 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:42,612 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x202E0000) -> AllocationBase 0x202E0000 RegionSize 0x4096.
2020-01-14 13:36:42,612 [root] DEBUG: DLL loaded at 0x000007FEFA6D0000: C:\Windows\system32\wbem\ncprov (0x16000 bytes).
2020-01-14 13:36:42,644 [root] DEBUG: AddTrackedRegion: New region at 0x202E0000 size 0x1000 added to tracked regions.
2020-01-14 13:36:42,660 [root] DEBUG: Allocation: 0x202E1000 - 0x202E2000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:42,660 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:36:42,660 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:42,660 [root] DEBUG: Loader: Injecting process 2152 (thread 1252) with C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:42,660 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:42,660 [root] DEBUG: Process image base: 0x00000000FF930000
2020-01-14 13:36:42,690 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:42,690 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:42,737 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:42,737 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-01-14 13:36:42,737 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:42,737 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1748.
2020-01-14 13:36:42,753 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:36:42,785 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:42,785 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1564.
2020-01-14 13:36:42,785 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2152
2020-01-14 13:36:42,785 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2340.
2020-01-14 13:36:42,832 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:42,832 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:36:42,846 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:42,846 [root] DEBUG: Process dumps disabled.
2020-01-14 13:36:42,846 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:42,846 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:42,846 [root] INFO: Disabling sleep skipping.
2020-01-14 13:36:42,862 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:42,862 [root] WARNING: Unable to place hook on LockResource
2020-01-14 13:36:42,862 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:42,862 [root] WARNING: Unable to hook LockResource
2020-01-14 13:36:42,862 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:42,862 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-01-14 13:36:42,878 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:42,878 [root] DEBUG: Debugger initialised.
2020-01-14 13:36:42,878 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:42,878 [root] DEBUG: CAPE initialised: 64-bit Extraction package loaded in process 2152 at 0x0000000074130000, image base 0x00000000FF930000, stack from 0x00000000001F0000-0x0000000000200000
2020-01-14 13:36:42,878 [root] DEBUG: Commandline: C:\Windows\sysnative\wbem\wmiprvse.exe -secured -Embedding.
2020-01-14 13:36:42,878 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:42,878 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:42,878 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00000000FF930000) returned 0x0000000000000000.
2020-01-14 13:36:42,878 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:36:42,878 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x0000000000000000.
2020-01-14 13:36:42,894 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x202E0000, size: 0x1000.
2020-01-14 13:36:42,894 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00000000FF930000) -> AllocationBase 0x00000000FF930000 RegionSize 0x4096.
2020-01-14 13:36:42,924 [root] DEBUG: Allocation: 0x000AA000 - 0x000AB000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:42,924 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:42,956 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:42,956 [root] DEBUG: AddTrackedRegion: EntryPoint 0xa9b4, Entropy 5.874603e+00
2020-01-14 13:36:42,956 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:42,956 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FF930000 size 0x1000 added to tracked regions.
2020-01-14 13:36:42,956 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:36:42,956 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:42,971 [root] INFO: Added new process to list with pid: 2152
2020-01-14 13:36:42,971 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:42,971 [root] INFO: Monitor successfully loaded in process with pid 2152.
2020-01-14 13:36:42,971 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:43,003 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:43,003 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:43,003 [root] DEBUG: DLL loaded at 0x000007FEFD780000: C:\Windows\system32\CRYPTBASE (0xf000 bytes).
2020-01-14 13:36:43,003 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:43,003 [root] DEBUG: DLL loaded at 0x000007FEFC9C0000: C:\Windows\system32\ntmarta (0x2d000 bytes).
2020-01-14 13:36:43,019 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:43,019 [root] DEBUG: DLL loaded at 0x000007FEFDC60000: C:\Windows\system32\WLDAP32 (0x52000 bytes).
2020-01-14 13:36:43,019 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:43,019 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:43,019 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:43,019 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:43,033 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:43,033 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:43,049 [root] DEBUG: DLL loaded at 0x000007FEFF860000: C:\Windows\system32\CLBCatQ (0x99000 bytes).
2020-01-14 13:36:43,049 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:43,081 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:36:43,096 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2472.
2020-01-14 13:36:43,096 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x000A0000, size: 0x1000.
2020-01-14 13:36:43,096 [root] DEBUG: Allocation: 0x000AB000 - 0x000AC000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:43,096 [root] DEBUG: DLL unloaded from 0x0000000077940000.
2020-01-14 13:36:43,111 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:43,128 [root] DEBUG: DLL loaded at 0x000007FEFA7D0000: C:\Windows\system32\wbem\wbemprox (0xf000 bytes).
2020-01-14 13:36:43,128 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:43,144 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2244.
2020-01-14 13:36:43,144 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:43,144 [root] DEBUG: DLL loaded at 0x000007FEFD120000: C:\Windows\system32\CRYPTSP (0x17000 bytes).
2020-01-14 13:36:43,158 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:43,158 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:43,174 [root] DEBUG: DLL loaded at 0x000007FEFCE20000: C:\Windows\system32\rsaenh (0x47000 bytes).
2020-01-14 13:36:43,174 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:43,174 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:43,174 [root] DEBUG: DLL loaded at 0x000007FEFD830000: C:\Windows\system32\RpcRtRemote (0x14000 bytes).
2020-01-14 13:36:43,190 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:43,190 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:43,190 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:43,190 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2624.
2020-01-14 13:36:43,206 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:43,236 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:43,236 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:43,253 [root] DEBUG: DLL loaded at 0x000007FEF9C80000: C:\Windows\system32\wbem\wbemsvc (0x14000 bytes).
2020-01-14 13:36:43,253 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:43,267 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:43,283 [root] DEBUG: DLL loaded at 0x000007FEFAB80000: C:\Windows\system32\wbem\wmiutils (0x26000 bytes).
2020-01-14 13:36:43,283 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:43,283 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:43,299 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:36:43,331 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x000A0000, size: 0x1000.
2020-01-14 13:36:43,408 [root] DEBUG: DLL loaded at 0x000007FEF4260000: C:\Windows\system32\wbem\cimwin32 (0x1fa000 bytes).
2020-01-14 13:36:43,440 [root] DEBUG: DLL loaded at 0x000007FEF4460000: C:\Windows\system32\framedynos (0x4c000 bytes).
2020-01-14 13:36:43,533 [root] DEBUG: DLL loaded at 0x000007FEFB7F0000: C:\Windows\system32\WTSAPI32 (0x11000 bytes).
2020-01-14 13:36:44,313 [root] DEBUG: DLL loaded at 0x0000000072080000: C:\Windows\system32\WMI (0x3000 bytes).
2020-01-14 13:36:44,453 [root] DEBUG: CreateThread: Initialising breakpoints for thread 332.
2020-01-14 13:36:45,358 [root] DEBUG: DLL loaded at 0x71F70000: C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\System.Management.ni (0x104000 bytes).
2020-01-14 13:36:45,529 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2652.
2020-01-14 13:36:45,576 [root] DEBUG: DLL unloaded from 0x77B20000.
2020-01-14 13:36:45,951 [root] DEBUG: Allocation: 0x7EF30000 - 0x7EF80000, size: 0x50000, protection: 0x40.
2020-01-14 13:36:45,997 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:46,061 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:46,154 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:46,232 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:46,295 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:46,342 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:46,388 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:46,482 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:46,543 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:46,668 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:46,732 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:46,825 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:46,966 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:47,043 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:47,089 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:47,200 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:47,309 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:47,355 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:36:47,417 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x7EF30000, size: 0x50000.
2020-01-14 13:36:47,589 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 16.
2020-01-14 13:36:47,776 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x7EF30000) returned 0x00000000.
2020-01-14 13:36:47,869 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:36:47,980 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x7EF30000) -> AllocationBase 0x7EF30000 RegionSize 0x327680.
2020-01-14 13:36:48,119 [root] DEBUG: AddTrackedRegion: New region at 0x7EF30000 size 0x50000 added to tracked regions.
2020-01-14 13:36:48,151 [root] DEBUG: AllocationHandler: Memory reserved but not committed at 0x7EF30000.
2020-01-14 13:36:48,292 [root] DEBUG: Allocation: 0x7EF30000 - 0x7EF31000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:48,338 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:48,369 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:48,401 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:48,479 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:48,572 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:48,697 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:48,805 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:48,900 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:49,009 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:49,102 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:49,196 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:49,664 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:49,930 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:50,085 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:50,194 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:50,506 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:50,663 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:50,802 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:36:50,927 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:36:51,145 [root] DEBUG: AllocationHandler: Previously reserved region 0x7EF30000 - 0x7EF80000, committing at: 0x7EF30000.
2020-01-14 13:36:51,256 [root] DEBUG: Allocation: 0x7EF30000 - 0x7EF31000, size: 0x1000, protection: 0x40.
2020-01-14 13:36:51,365 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:51,443 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:51,582 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:51,677 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:51,786 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:51,926 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:52,128 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:36:52,223 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:36:52,644 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:36:53,657 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:36:53,938 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:36:54,125 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:36:54,967 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:36:55,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:36:55,296 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:36:55,467 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:36:55,717 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:36:55,825 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:36:56,309 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:36:56,434 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x7EF30000, size: 0x50000.
2020-01-14 13:36:56,668 [root] DEBUG: Allocation: 0x7EF20000 - 0x7EF30000, size: 0x10000, protection: 0x40.
2020-01-14 13:36:56,809 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:36:57,184 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:36:57,917 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:36:58,151 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:36:58,463 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:36:59,523 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:36:59,694 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:00,756 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:01,052 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:01,598 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:02,644 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:02,644 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:02,753 [root] DEBUG: DLL unloaded from 0x0000000072080000.
2020-01-14 13:37:02,753 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:02,783 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:02,861 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:02,861 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:02,878 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:02,878 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:02,878 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:02,956 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x7EF20000, size: 0x10000.
2020-01-14 13:37:02,956 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 17.
2020-01-14 13:37:02,970 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x7EF20000) returned 0x00000000.
2020-01-14 13:37:02,986 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:37:03,002 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x7EF20000) -> AllocationBase 0x7EF20000 RegionSize 0x65536.
2020-01-14 13:37:03,002 [root] DEBUG: AddTrackedRegion: New region at 0x7EF20000 size 0x10000 added to tracked regions.
2020-01-14 13:37:03,002 [root] DEBUG: AllocationHandler: Memory reserved but not committed at 0x7EF20000.
2020-01-14 13:37:03,079 [root] DEBUG: Allocation: 0x7EF20000 - 0x7EF21000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:03,127 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:03,157 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:03,174 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:03,190 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:03,190 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:03,313 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:03,329 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:03,377 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:03,391 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:03,391 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:03,391 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:03,407 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:03,424 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:03,424 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:03,424 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:03,438 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:03,438 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:03,438 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:03,438 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:03,438 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:03,438 [root] DEBUG: AllocationHandler: Previously reserved region 0x7EF20000 - 0x7EF30000, committing at: 0x7EF20000.
2020-01-14 13:37:03,516 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2720.
2020-01-14 13:37:03,750 [root] DEBUG: DLL loaded at 0x6A310000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils (0x9000 bytes).
2020-01-14 13:37:03,766 [root] DEBUG: Allocation: 0x203E0000 - 0x203E1000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:03,766 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:03,845 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:03,845 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:03,859 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:03,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:03,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:03,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:03,970 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:04,157 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:04,219 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:04,219 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:04,234 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:04,282 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:04,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:04,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:04,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:04,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:04,483 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:04,608 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:04,625 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:04,625 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x203E0000, size: 0x1000.
2020-01-14 13:37:04,655 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 18.
2020-01-14 13:37:04,655 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x203E0000) returned 0x00000000.
2020-01-14 13:37:04,703 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:37:04,717 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x203E0000) -> AllocationBase 0x203E0000 RegionSize 0x4096.
2020-01-14 13:37:04,780 [root] DEBUG: AddTrackedRegion: New region at 0x203E0000 size 0x1000 added to tracked regions.
2020-01-14 13:37:04,999 [root] DEBUG: Allocation: 0x203E1000 - 0x203E2000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:05,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:05,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:05,076 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:05,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:05,217 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:05,233 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:05,638 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:05,779 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:05,825 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:05,934 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:06,043 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:06,091 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:06,216 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:06,278 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:06,434 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:06,543 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:06,714 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:06,778 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:06,823 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:07,260 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:07,385 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:07,433 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x203E0000, size: 0x1000.
2020-01-14 13:37:07,510 [root] DEBUG: Allocation: 0x203E2000 - 0x203E3000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:07,558 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:08,088 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:08,134 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:08,789 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:08,993 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:09,351 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:09,398 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:09,507 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:09,539 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:09,742 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:09,851 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:09,990 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:10,022 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:10,288 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:10,288 [root] DEBUG: DLL unloaded from 0x000007FEFA010000.
2020-01-14 13:37:10,288 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:10,302 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:10,302 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:10,349 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:10,397 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:10,444 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:10,506 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:10,552 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x203E0000, size: 0x1000.
2020-01-14 13:37:10,723 [root] DEBUG: Allocation: 0x203E3000 - 0x203E4000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:10,927 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:11,052 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:11,145 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:11,161 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:11,348 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:11,380 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:11,536 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:11,566 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:11,815 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:11,832 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:12,019 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:12,035 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:12,533 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:12,533 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:12,720 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:12,829 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:12,940 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:12,970 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:13,141 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:13,157 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:13,345 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:13,734 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x203E0000, size: 0x1000.
2020-01-14 13:37:13,750 [root] DEBUG: set_caller_info: Adding region at 0x203E0000 to caller regions list (ole32::CoCreateInstance).
2020-01-14 13:37:13,828 [root] DEBUG: set_caller_info: Caller at 0x203E35AF in tracked regions.
2020-01-14 13:37:13,921 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:14,016 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:14,141 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:14,155 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:14,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:14,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:14,344 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:14,344 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1a50 in capemon caught accessing 0x90000 (expected in memory scans), passing to next handler.
2020-01-14 13:37:14,375 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:14,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:14,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:14,467 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:14,546 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:14,592 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:14,749 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:14,779 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:14,874 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:14,904 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:15,029 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:15,029 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:15,138 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:15,138 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:15,295 [root] DEBUG: DumpPEsInRange: Scanning range 0x203e0000 - 0x203e1000.
2020-01-14 13:37:15,325 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x203e0000-0x203e1000.
2020-01-14 13:37:15,513 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x203E0000 - 0x203E1000.
2020-01-14 13:37:15,513 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_13012688655212114212020 successfully created, size 0x10000
2020-01-14 13:37:15,575 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x3ff2e in capemon caught accessing 0x203e4000 (expected in memory scans), passing to next handler.
2020-01-14 13:37:15,592 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x203e0000
2020-01-14 13:37:15,732 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x203E0000 size 0x10000.
2020-01-14 13:37:15,779 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_36248148855212114212020 successfully created, size 0x4000
2020-01-14 13:37:16,230 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_36248148855212114212020
2020-01-14 13:37:16,230 [root] DEBUG: DumpRegion: Dumped stack region from 0x203E0000, size 0x4000.
2020-01-14 13:37:16,528 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x203E0000.
2020-01-14 13:37:16,684 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x203e0000 - 0x203e1000.
2020-01-14 13:37:16,933 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1308.
2020-01-14 13:37:18,586 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1344.
2020-01-14 13:37:19,039 [root] DEBUG: set_caller_info: Adding region at 0x000A0000 to caller regions list (msvcrt::memcpy).
2020-01-14 13:37:19,039 [root] DEBUG: set_caller_info: Caller at 0x000ABEBB in tracked regions.
2020-01-14 13:37:19,210 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:19,210 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:19,694 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:19,865 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:20,115 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:20,131 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:20,161 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:20,286 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1a50 in capemon caught accessing 0x90000 (expected in memory scans), passing to next handler.
2020-01-14 13:37:20,490 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:20,506 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:20,677 [root] DEBUG: DumpPEsInRange: Scanning range 0xa0000 - 0xa1000.
2020-01-14 13:37:20,693 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xa0000-0xa1000.
2020-01-14 13:37:22,267 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x000A0000 - 0x000A1000.
2020-01-14 13:37:22,267 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_5921913442242114212020 successfully created, size 0x10000
2020-01-14 13:37:22,392 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x3ff2e in capemon caught accessing 0xa1000 (expected in memory scans), passing to next handler.
2020-01-14 13:37:22,408 [root] DEBUG: DumpMemory: Exception occured reading memory address 0xa0000
2020-01-14 13:37:22,517 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x000A0000 size 0x10000.
2020-01-14 13:37:22,549 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_8544913082242114212020 successfully created, size 0x1000
2020-01-14 13:37:23,111 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_8544913082242114212020
2020-01-14 13:37:23,111 [root] DEBUG: DLL unloaded from 0x000007FEFEC40000.
2020-01-14 13:37:23,328 [root] DEBUG: DumpRegion: Dumped stack region from 0x000A0000, size 0x1000.
2020-01-14 13:37:23,328 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x000A0000.
2020-01-14 13:37:23,437 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0xa0000 - 0xa1000.
2020-01-14 13:37:23,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:23,532 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:23,532 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:23,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:24,046 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:24,187 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:24,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:24,233 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:24,233 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:24,312 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:24,405 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:24,624 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:25,122 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1548.
2020-01-14 13:37:25,122 [root] DEBUG: DLL unloaded from 0x0000000077940000.
2020-01-14 13:37:25,591 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1816.
2020-01-14 13:37:25,684 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2436.
2020-01-14 13:37:25,966 [root] DEBUG: Allocation: 0x203F0000 - 0x203F1000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:26,012 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:26,059 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:26,089 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:26,230 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:26,309 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:26,496 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:26,558 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:26,589 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2012.
2020-01-14 13:37:26,589 [root] DEBUG: DLL unloaded from 0x0000000077940000.
2020-01-14 13:37:26,667 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:26,667 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:26,963 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:27,010 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:27,088 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:27,088 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:27,244 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:27,244 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:27,244 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:27,338 [root] DEBUG: DLL unloaded from 0x000007FEFF2E0000.
2020-01-14 13:37:27,338 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:27,354 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:27,447 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:27,479 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:27,509 [root] DEBUG: DLL loaded at 0x000007FEFC070000: C:\Windows\System32\perfos (0xb000 bytes).
2020-01-14 13:37:27,572 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:27,681 [root] DEBUG: AllocationHandler: Adding allocation to tracked region list: 0x203F0000, size: 0x1000.
2020-01-14 13:37:28,476 [root] DEBUG: AddTrackedRegion: DEBUG Warning - number of tracked regions 19.
2020-01-14 13:37:28,571 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x203F0000) returned 0x00000000.
2020-01-14 13:37:28,571 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x00000000.
2020-01-14 13:37:28,757 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x203F0000) -> AllocationBase 0x203F0000 RegionSize 0x4096.
2020-01-14 13:37:28,773 [root] DEBUG: DLL unloaded from 0x77390000.
2020-01-14 13:37:28,944 [root] DEBUG: AddTrackedRegion: New region at 0x203F0000 size 0x1000 added to tracked regions.
2020-01-14 13:37:46,667 [root] DEBUG: DLL unloaded from 0x000007FEFEC40000.
2020-01-14 13:37:47,976 [root] DEBUG: Allocation: 0x226F8000 - 0x226F9000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:48,101 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:48,101 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:48,569 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:48,585 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:48,710 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:48,726 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:49,349 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:49,381 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:49,444 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:49,552 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:49,959 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:50,020 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:50,332 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:50,348 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:50,473 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:50,473 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:50,473 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:50,473 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:50,489 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:50,489 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:50,489 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:50,489 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:37:50,505 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:37:50,739 [root] DEBUG: set_caller_info: Adding region at 0x203F0000 to caller regions list (advapi32::LookupPrivilegeValueW).
2020-01-14 13:37:50,785 [root] DEBUG: set_caller_info: Caller at 0x203F01A4 in tracked regions.
2020-01-14 13:37:50,785 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:50,894 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:50,910 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:51,221 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:51,221 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:51,565 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:51,565 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:52,002 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x1a50 in capemon caught accessing 0x90000 (expected in memory scans), passing to next handler.
2020-01-14 13:37:52,017 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:52,142 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:52,174 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:52,236 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:52,252 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:52,313 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:52,345 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:52,423 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:52,500 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:52,673 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:52,688 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:52,688 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:52,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:52,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:52,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:37:53,000 [root] DEBUG: DumpPEsInRange: Scanning range 0x203f0000 - 0x203f1000.
2020-01-14 13:37:53,016 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x203f0000-0x203f1000.
2020-01-14 13:37:53,046 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x203F0000 - 0x203F1000.
2020-01-14 13:37:53,125 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_65805719733262114212020 successfully created, size 0x10000
2020-01-14 13:37:53,234 [root] DEBUG: CAPEExceptionFilter: Exception 0xc0000005 caught at RVA 0x3ff2e in capemon caught accessing 0x203f1000 (expected in memory scans), passing to next handler.
2020-01-14 13:37:53,234 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x203f0000
2020-01-14 13:37:53,250 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x203F0000 size 0x10000.
2020-01-14 13:37:53,266 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_36470301433262114212020 successfully created, size 0x1000
2020-01-14 13:37:54,186 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_36470301433262114212020
2020-01-14 13:37:54,186 [root] DEBUG: DumpRegion: Dumped stack region from 0x203F0000, size 0x1000.
2020-01-14 13:37:54,295 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x203F0000.
2020-01-14 13:37:54,358 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x203f0000 - 0x203f1000.
2020-01-14 13:37:54,420 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2480.
2020-01-14 13:37:54,420 [root] DEBUG: DLL unloaded from 0x77B20000.
2020-01-14 13:37:54,700 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1524.
2020-01-14 13:37:54,717 [root] DEBUG: CreateThread: Initialising breakpoints for thread 2700.
2020-01-14 13:37:54,747 [root] DEBUG: Allocation: 0x003E3000 - 0x003E4000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:54,747 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:54,763 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:54,763 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:54,795 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:54,795 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:55,138 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:55,153 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:55,168 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:55,168 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:55,341 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:55,418 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:55,605 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:55,605 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:55,776 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:55,792 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:55,917 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:55,933 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1272.
2020-01-14 13:37:56,338 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:56,385 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:56,494 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:56,494 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:56,651 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:56,868 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:37:56,963 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003E0000, size: 0x2000.
2020-01-14 13:37:56,979 [root] DEBUG: CreateThread: Initialising breakpoints for thread 1640.
2020-01-14 13:37:57,197 [root] DEBUG: Allocation: 0x226F9000 - 0x226FC000, size: 0x3000, protection: 0x40.
2020-01-14 13:37:57,243 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:57,571 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:57,602 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:57,680 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:57,696 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:57,930 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:57,930 [root] DEBUG: DLL unloaded from 0x77390000.
2020-01-14 13:37:58,039 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:58,055 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:58,132 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:58,180 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:58,194 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:58,194 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:58,210 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:58,210 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:58,210 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:58,210 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:58,305 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:58,305 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:58,319 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:58,335 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:58,428 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:58,444 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:37:58,553 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:37:58,569 [root] DEBUG: DLL loaded at 0x75050000: C:\Windows\system32\shfolder (0x5000 bytes).
2020-01-14 13:37:58,663 [root] DEBUG: Allocation: 0x226FC000 - 0x226FD000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:58,663 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:37:59,147 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:37:59,147 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:37:59,302 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:37:59,443 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:37:59,443 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:37:59,459 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:37:59,536 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:37:59,536 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:37:59,536 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:37:59,552 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:37:59,552 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:37:59,552 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:37:59,661 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:37:59,661 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:37:59,693 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:37:59,693 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:37:59,709 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:37:59,709 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:37:59,709 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:37:59,723 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:37:59,880 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:37:59,911 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:37:59,973 [root] DEBUG: Allocation: 0x003E4000 - 0x003E5000, size: 0x1000, protection: 0x40.
2020-01-14 13:37:59,973 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:00,020 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:00,066 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:00,066 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:00,066 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:00,191 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:00,191 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:00,207 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:00,207 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:00,223 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:00,223 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:00,239 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:00,239 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:00,269 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:00,316 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:00,332 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:00,332 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:00,378 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:00,411 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:00,551 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:00,769 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:00,769 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:00,785 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003E0000, size: 0x2000.
2020-01-14 13:38:01,003 [root] DEBUG: Allocation: 0x00093000 - 0x00094000, size: 0x1000, protection: 0x40.
2020-01-14 13:38:01,065 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:01,112 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:01,158 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:01,158 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:01,174 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:01,283 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:01,315 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:01,486 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:01,503 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:01,517 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:01,533 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:01,565 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:01,565 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:01,642 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:01,642 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:01,690 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:01,690 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:01,752 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:01,752 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:01,767 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:01,782 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:01,815 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:01,815 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00090000, size: 0x1000.
2020-01-14 13:38:01,954 [root] DEBUG: Allocation: 0x00155000 - 0x00156000, size: 0x1000, protection: 0x40.
2020-01-14 13:38:01,986 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:02,002 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:02,002 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:02,032 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:02,032 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:02,095 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:02,127 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:02,173 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:02,188 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:02,204 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:02,220 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:02,236 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:02,236 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:02,407 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:02,438 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:02,548 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:02,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:02,641 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:02,657 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:02,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:02,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:02,734 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:02,734 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00150000, size: 0x1000.
2020-01-14 13:38:02,953 [root] DEBUG: Allocation: 0x226FD000 - 0x226FE000, size: 0x1000, protection: 0x40.
2020-01-14 13:38:02,953 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:02,969 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:02,969 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:02,969 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:02,969 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:02,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:02,984 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:02,984 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:03,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:03,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:03,219 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:03,219 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:03,437 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:03,483 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:03,483 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:03,499 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:03,499 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:03,515 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:03,530 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:03,530 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:03,530 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:03,562 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:03,562 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:38:03,654 [root] DEBUG: Allocation: 0x226FE000 - 0x22700000, size: 0x2000, protection: 0x40.
2020-01-14 13:38:03,654 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:03,671 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:03,671 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:03,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:03,687 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:03,717 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:03,717 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:03,765 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:03,765 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:04,138 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:04,559 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:04,559 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:04,559 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:04,591 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:04,638 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:04,638 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:04,638 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:04,746 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:04,746 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:04,857 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:04,871 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:05,605 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:05,621 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x226E0000, size: 0x1000.
2020-01-14 13:38:05,730 [root] DEBUG: DLL loaded at 0x60340000: C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture (0x8000 bytes).
2020-01-14 13:38:05,746 [root] DEBUG: DLL unloaded from 0x60340000.
2020-01-14 13:38:05,980 [root] DEBUG: Allocation: 0x003E5000 - 0x003E6000, size: 0x1000, protection: 0x40.
2020-01-14 13:38:05,994 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:06,010 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:06,026 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:06,072 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:06,072 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:06,119 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:06,135 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:06,151 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:06,151 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:06,167 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:06,167 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:06,183 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:06,183 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:06,197 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:06,197 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:06,244 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:06,244 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:06,244 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:06,260 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:06,276 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:06,292 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:06,292 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:06,292 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003E0000, size: 0x2000.
2020-01-14 13:38:06,306 [root] DEBUG: Allocation: 0x0014C000 - 0x0014D000, size: 0x1000, protection: 0x40.
2020-01-14 13:38:06,306 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:06,401 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:06,790 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:06,900 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:06,900 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:06,900 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:06,915 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:07,025 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:07,040 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:07,040 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:07,118 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:07,243 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:07,243 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:07,384 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:07,398 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:07,648 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:07,757 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:07,805 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:07,805 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:07,882 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:08,335 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:08,398 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:08,444 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x00140000, size: 0x1000.
2020-01-14 13:38:08,585 [root] DEBUG: Allocation: 0x003E6000 - 0x003E7000, size: 0x1000, protection: 0x40.
2020-01-14 13:38:08,601 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:08,631 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:08,724 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:08,724 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:08,897 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:09,069 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:09,084 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:09,334 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:09,645 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:09,848 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:09,864 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:09,911 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:09,927 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:10,582 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:10,596 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:11,065 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:11,096 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:11,128 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:11,142 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:11,345 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:11,470 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:11,657 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:11,907 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x003E0000, size: 0x2000.
2020-01-14 13:38:12,078 [root] DEBUG: Allocation: 0x000AD000 - 0x000AE000, size: 0x1000, protection: 0x40.
2020-01-14 13:38:12,203 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:38:12,220 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:38:12,234 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:38:12,282 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:38:12,328 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:38:12,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:38:12,375 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:38:12,391 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:38:12,391 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:38:12,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:38:12,469 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:38:12,750 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:38:12,937 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:38:13,000 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:38:13,015 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:38:13,062 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:38:13,171 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:38:13,404 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:38:13,404 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:38:13,624 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF20000.
2020-01-14 13:38:13,624 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203E0000.
2020-01-14 13:38:13,763 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x203F0000.
2020-01-14 13:38:13,763 [root] DEBUG: AllocationHandler: New allocation already in tracked region list: 0x000A0000, size: 0x1000.
2020-01-14 13:38:14,122 [root] DEBUG: DLL loaded at 0x71450000: C:\Windows\SysWOW64\ieframe (0xa80000 bytes).
2020-01-14 13:38:14,279 [root] DEBUG: DLL loaded at 0x75010000: C:\Windows\SysWOW64\OLEACC (0x3c000 bytes).
2020-01-14 13:38:14,388 [root] DEBUG: DLL loaded at 0x76B90000: C:\Windows\syswow64\iertutil (0x1fb000 bytes).
2020-01-14 13:38:14,388 [root] DEBUG: DLL loaded at 0x712B0000: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32 (0x19e000 bytes).
2020-01-14 13:38:14,887 [root] DEBUG: DLL loaded at 0x74FE0000: C:\Windows\system32\MLANG (0x2e000 bytes).
2020-01-14 13:38:14,934 [root] DEBUG: DLL loaded at 0x77020000: C:\Windows\syswow64\WININET (0xf5000 bytes).
2020-01-14 13:38:15,059 [root] DEBUG: DLL loaded at 0x76DB0000: C:\Windows\syswow64\urlmon (0x136000 bytes).
2020-01-14 13:38:15,059 [root] DEBUG: DLL loaded at 0x76F00000: C:\Windows\syswow64\CRYPT32 (0x11d000 bytes).
2020-01-14 13:38:15,309 [root] DEBUG: DLL loaded at 0x77AF0000: C:\Windows\syswow64\MSASN1 (0xc000 bytes).
2020-01-14 13:38:16,104 [root] DEBUG: DLL loaded at 0x74FD0000: C:\Windows\system32\vaultcli (0xc000 bytes).
2020-01-14 13:38:16,134 [root] DEBUG: DLL unloaded from 0x757F0000.
2020-01-14 13:38:16,384 [root] INFO: Announced starting service "VaultSvc"
2020-01-14 13:38:16,384 [root] INFO: Attaching to Service Control Manager (services.exe - pid 460)
2020-01-14 13:38:16,447 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:38:16,447 [lib.api.process] INFO: 64-bit DLL to inject is C:\mmwcpkjad\dll\vRlBbyA.dll, loader C:\mmwcpkjad\bin\otGOKhGg.exe
2020-01-14 13:38:16,509 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:38:16,525 [root] DEBUG: Loader: Injecting process 460 (thread 0) with C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:38:16,525 [root] DEBUG: InjectDll: No thread ID supplied, GetProcessInitialThreadId failed, falling back to thread injection.
2020-01-14 13:38:16,665 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:38:16,665 [root] DEBUG: Process dumps disabled.
2020-01-14 13:38:17,226 [root] INFO: Disabling sleep skipping.
2020-01-14 13:38:17,351 [root] WARNING: Unable to place hook on LockResource
2020-01-14 13:38:17,351 [root] WARNING: Unable to hook LockResource
2020-01-14 13:38:17,601 [root] DEBUG: Debugger initialised.
2020-01-14 13:38:17,632 [root] DEBUG: CAPE initialised: 64-bit Extraction package loaded in process 460 at 0x0000000074130000, image base 0x00000000FFD10000, stack from 0x00000000015D6000-0x00000000015E0000
2020-01-14 13:38:17,726 [root] DEBUG: Commandline: C:\Windows\sysnative\services.exe.
2020-01-14 13:38:17,742 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00000000FFD10000) returned 0x0000000000000000.
2020-01-14 13:38:18,148 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x0000000000000000.
2020-01-14 13:38:18,210 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00000000FFD10000) -> AllocationBase 0x00000000FFD10000 RegionSize 0x4096.
2020-01-14 13:38:18,273 [root] DEBUG: AddTrackedRegion: EntryPoint 0x13310, Entropy 6.073964e+00
2020-01-14 13:38:18,303 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FFD10000 size 0x1000 added to tracked regions.
2020-01-14 13:38:18,351 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:38:18,351 [root] INFO: Added new process to list with pid: 460
2020-01-14 13:38:18,365 [root] INFO: Monitor successfully loaded in process with pid 460.
2020-01-14 13:38:18,615 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.
2020-01-14 13:38:18,709 [root] DEBUG: InjectDll: Successfully injected DLL via thread.
2020-01-14 13:38:19,223 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:38:20,253 [root] INFO: Announced 64-bit process name: lsass.exe pid: 2572
2020-01-14 13:38:20,285 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:38:20,285 [lib.api.process] INFO: 64-bit DLL to inject is C:\mmwcpkjad\dll\vRlBbyA.dll, loader C:\mmwcpkjad\bin\otGOKhGg.exe
2020-01-14 13:38:20,487 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:38:21,049 [root] DEBUG: Loader: Injecting process 2572 (thread 1464) with C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:38:21,127 [root] DEBUG: Process image base: 0x00000000FF120000
2020-01-14 13:38:21,190 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:38:21,190 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.
2020-01-14 13:38:21,267 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:38:21,267 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2572
2020-01-14 13:38:21,267 [root] INFO: Announced 64-bit process name: lsass.exe pid: 2572
2020-01-14 13:38:21,267 [lib.api.process] INFO: Option 'procdump' with value '0' sent to monitor
2020-01-14 13:38:21,282 [lib.api.process] INFO: 64-bit DLL to inject is C:\mmwcpkjad\dll\vRlBbyA.dll, loader C:\mmwcpkjad\bin\otGOKhGg.exe
2020-01-14 13:38:21,657 [root] DEBUG: ReadConfig: Successfully loaded pipe name \\.\PIPE\xLiarHoueR.
2020-01-14 13:38:21,673 [root] DEBUG: Loader: Injecting process 2572 (thread 1464) with C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:38:21,828 [root] DEBUG: Process image base: 0x00000000FF120000
2020-01-14 13:38:21,828 [root] DEBUG: InjectDllViaIAT: IAT patching with dll name C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:38:22,125 [root] DEBUG: InjectDllViaIAT: This image has already been patched.
2020-01-14 13:38:22,125 [root] DEBUG: Successfully injected DLL C:\mmwcpkjad\dll\vRlBbyA.dll.
2020-01-14 13:38:22,141 [lib.api.process] INFO: Injected into suspended 64-bit process with pid 2572
2020-01-14 13:38:22,375 [root] DEBUG: Terminate processes on terminate_event enabled.
2020-01-14 13:38:22,530 [root] DEBUG: Process dumps disabled.
2020-01-14 13:38:22,655 [root] INFO: Disabling sleep skipping.
2020-01-14 13:38:22,703 [root] WARNING: Unable to place hook on LockResource
2020-01-14 13:38:23,076 [root] WARNING: Unable to hook LockResource
2020-01-14 13:38:23,092 [root] DEBUG: RestoreHeaders: Restored original import table.
2020-01-14 13:38:23,108 [root] DEBUG: Debugger initialised.
2020-01-14 13:38:23,124 [root] DEBUG: CAPE initialised: 64-bit Extraction package loaded in process 2572 at 0x0000000074130000, image base 0x00000000FF120000, stack from 0x00000000001D4000-0x00000000001E0000
2020-01-14 13:38:23,140 [root] DEBUG: Commandline: C:\Windows\sysnative\lsass.exe.
2020-01-14 13:38:23,171 [root] DEBUG: AddTrackedRegion: GetTrackedRegion(0x00000000FF120000) returned 0x0000000000000000.
2020-01-14 13:38:23,201 [root] DEBUG: AddTrackedRegion: Created new tracked region: TrackedRegion->AllocationBase 0x0000000000000000.
2020-01-14 13:38:23,233 [root] DEBUG: AddTrackedRegion: VirtualQuery(0x00000000FF120000) -> AllocationBase 0x00000000FF120000 RegionSize 0x4096.
2020-01-14 13:38:23,279 [root] DEBUG: AddTrackedRegion: EntryPoint 0x1850, Entropy 3.685174e+00
2020-01-14 13:38:23,296 [root] DEBUG: AddTrackedRegion: New region at 0x00000000FF120000 size 0x1000 added to tracked regions.
2020-01-14 13:38:23,592 [root] DEBUG: ExtractionInit: Adding main image base to tracked regions.
2020-01-14 13:38:23,654 [root] INFO: Added new process to list with pid: 2572
2020-01-14 13:38:23,670 [root] INFO: Monitor successfully loaded in process with pid 2572.
2020-01-14 13:38:52,374 [root] DEBUG: NtTerminateProcess hook: Processing tracked regions before shutdown (process 460).
2020-01-14 13:38:52,374 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x0000000000000000.
2020-01-14 13:38:52,374 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000FFD10000.
2020-01-14 13:38:52,390 [root] DEBUG: ProcessImageBase: EP 0x0000000000013310 image base 0x00000000FFD10000 size 0x0 entropy 6.074201e+00.
2020-01-14 13:38:52,421 [root] DEBUG: ClearAllBreakpoints: Error getting thread context for thread 1672.
2020-01-14 13:38:52,421 [root] INFO: Notified of termination of process with pid 2572.
2020-01-14 13:38:52,576 [root] DEBUG: Allocation: 0x23C20000 - 0x23C21000, size: 0x1000, protection: 0x40.
2020-01-14 13:38:52,576 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 2572).
2020-01-14 13:39:01,391 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:39:01,796 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:39:02,015 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:39:02,374 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:39:02,374 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:39:02,404 [root] INFO: Analysis timeout hit (200 seconds), terminating analysis.
2020-01-14 13:39:02,421 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:39:02,421 [root] INFO: Created shutdown mutex.
2020-01-14 13:39:03,418 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:39:06,726 [lib.api.process] INFO: Terminate event set for process 2612
2020-01-14 13:39:06,726 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:39:06,726 [root] DEBUG: Terminate Event: Processing tracked regions before shutdown (process 2612).
2020-01-14 13:39:06,742 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:39:06,756 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00000000.
2020-01-14 13:39:06,756 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:39:06,756 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00400000.
2020-01-14 13:39:06,756 [root] DEBUG: DumpPEsInRange: Scanning range 0x150000 - 0x151000.
2020-01-14 13:39:06,773 [root] DEBUG: ProcessImageBase: EP 0x0000FFEF image base 0x00400000 size 0x0 entropy 3.113782e+00.
2020-01-14 13:39:06,773 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x150000-0x151000.
2020-01-14 13:39:06,789 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00300000.
2020-01-14 13:39:06,789 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00150000 - 0x00151000.
2020-01-14 13:39:06,789 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000C0000.
2020-01-14 13:39:06,789 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_15700635676391314212020 successfully created, size 0x10000
2020-01-14 13:39:06,803 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000B0000.
2020-01-14 13:39:06,803 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x150000
2020-01-14 13:39:06,928 [root] DEBUG: DumpPEsInRange: Scanning range 0xb0000 - 0xb140a.
2020-01-14 13:39:06,928 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00150000 size 0x10000.
2020-01-14 13:39:06,944 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0xb0000-0xb140a.
2020-01-14 13:39:06,944 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_7496509186391314212020 successfully created, size 0x1000
2020-01-14 13:39:06,944 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x000B0000 - 0x000B140A.
2020-01-14 13:39:06,960 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_1521321526391314212020 successfully created, size 0x10000
2020-01-14 13:39:06,960 [root] DEBUG: DumpMemory: Exception occured reading memory address 0xb0000
2020-01-14 13:39:06,976 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x000B0000 size 0x10000.
2020-01-14 13:39:07,053 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_7496509186391314212020
2020-01-14 13:39:07,053 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_11134098886391314212020 successfully created, size 0x1000
2020-01-14 13:39:07,101 [root] DEBUG: DumpRegion: Dumped stack region from 0x00150000, size 0x1000.
2020-01-14 13:39:07,147 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00150000.
2020-01-14 13:39:07,147 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x150000 - 0x151000.
2020-01-14 13:39:07,194 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:39:07,194 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_11134098886391314212020
2020-01-14 13:39:07,194 [root] DEBUG: DumpPEsInRange: Scanning range 0x20490000 - 0x20491000.
2020-01-14 13:39:07,381 [root] DEBUG: DumpRegion: Dumped stack region from 0x000B0000, size 0x1000.
2020-01-14 13:39:07,693 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x000B0000.
2020-01-14 13:39:08,130 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x20490000-0x20491000.
2020-01-14 13:39:08,145 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0xb0000 - 0xb140a.
2020-01-14 13:39:08,145 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x20490000 - 0x20491000.
2020-01-14 13:39:08,161 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00090000.
2020-01-14 13:39:08,177 [root] DEBUG: ScanForNonZero: Exception occured reading memory address 0x90000
2020-01-14 13:39:08,427 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x000A0000.
2020-01-14 13:39:08,427 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_16477133778391314212020 successfully created, size 0x10000
2020-01-14 13:39:09,082 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x20490000
2020-01-14 13:39:09,970 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x20490000 size 0x10000.
2020-01-14 13:39:09,970 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00150000.
2020-01-14 13:39:10,079 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x20490000.
2020-01-14 13:39:10,079 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_6192477629391314212020 successfully created, size 0x1000
2020-01-14 13:39:10,095 [root] DEBUG: DumpPEsInRange: Scanning range 0x20490000 - 0x20491000.
2020-01-14 13:39:10,111 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x20490000-0x20491000.
2020-01-14 13:39:10,127 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_6192477629391314212020
2020-01-14 13:39:10,127 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x20490000 - 0x20491000.
2020-01-14 13:39:10,127 [root] DEBUG: DumpRegion: Dumped stack region from 0x20490000, size 0x1000.
2020-01-14 13:39:10,142 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_83869606110391314212020 successfully created, size 0x10000
2020-01-14 13:39:10,142 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x20490000.
2020-01-14 13:39:10,157 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x20490000
2020-01-14 13:39:10,157 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x20490000 - 0x20491000.
2020-01-14 13:39:10,157 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x20490000 size 0x10000.
2020-01-14 13:39:10,174 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_38519839810391314212020 successfully created, size 0x1000
2020-01-14 13:39:10,188 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:39:10,578 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:39:10,595 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_38519839810391314212020
2020-01-14 13:39:10,595 [root] DEBUG: DumpRegion: Dumped stack region from 0x20490000, size 0x1000.
2020-01-14 13:39:10,703 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x20490000.
2020-01-14 13:39:10,703 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:39:10,828 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x20490000 - 0x20491000.
2020-01-14 13:39:10,845 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x226E0000.
2020-01-14 13:39:10,845 [root] DEBUG: DumpPEsInRange: Scanning range 0x3e0000 - 0x3e2000.
2020-01-14 13:39:10,845 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x22700000.
2020-01-14 13:39:10,845 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3e0000-0x3e2000.
2020-01-14 13:39:10,859 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x003E0000 - 0x003E2000.
2020-01-14 13:39:10,907 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x003E0000.
2020-01-14 13:39:11,141 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_202268893910391314212020 successfully created, size 0x10000
2020-01-14 13:39:11,157 [root] DEBUG: DumpPEsInRange: Scanning range 0x3e0000 - 0x3e2000.
2020-01-14 13:39:11,469 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x3e0000-0x3e2000.
2020-01-14 13:39:11,469 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x3e0000
2020-01-14 13:39:11,469 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x003E0000 size 0x10000.
2020-01-14 13:39:11,483 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x003E0000 - 0x003E2000.
2020-01-14 13:39:11,483 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_109162533211391314212020 successfully created, size 0x10000
2020-01-14 13:39:11,483 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_61558280811391314212020 successfully created, size 0x7000
2020-01-14 13:39:11,530 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_61558280811391314212020
2020-01-14 13:39:11,703 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x3e0000
2020-01-14 13:39:11,703 [root] DEBUG: DumpRegion: Dumped stack region from 0x003E0000, size 0x7000.
2020-01-14 13:39:11,812 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x003E0000 size 0x10000.
2020-01-14 13:39:11,826 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003E0000.
2020-01-14 13:39:11,826 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_159312654411391314212020 successfully created, size 0x7000
2020-01-14 13:39:11,858 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3e0000 - 0x3e2000.
2020-01-14 13:39:11,904 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_159312654411391314212020
2020-01-14 13:39:11,904 [root] DEBUG: DumpRegion: Dumped stack region from 0x003E0000, size 0x7000.
2020-01-14 13:39:11,999 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x003E0000.
2020-01-14 13:39:11,999 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x003E0000.
2020-01-14 13:39:12,263 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:22,217 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x3e0000 - 0x3e2000.
2020-01-14 13:39:22,217 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:22,233 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:22,279 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 0 address 0x003E0000.
2020-01-14 13:39:22,279 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:22,279 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:22,342 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:22,342 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:22,342 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:22,482 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:22,482 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:22,668 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:23,917 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:23,917 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:24,026 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:24,058 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:24,058 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:24,447 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:24,634 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:24,729 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:24,790 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:24,790 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:25,009 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:25,055 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:25,055 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:25,072 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 1 address 0x003E003C.
2020-01-14 13:39:25,102 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:25,118 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:25,134 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:25,165 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:25,165 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:25,430 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:25,634 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:25,634 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoint 2 address 0x003E0000.
2020-01-14 13:39:25,680 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:25,696 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:25,821 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:25,851 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:26,849 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:26,865 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:26,913 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:26,944 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:27,084 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:27,256 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:27,490 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:27,848 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:27,880 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:27,973 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:27,989 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:28,144 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:28,394 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:28,551 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:28,676 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:28,676 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:28,956 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:29,065 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:39:29,470 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:29,627 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:30,188 [root] DEBUG: DumpPEsInRange: Scanning range 0x140000 - 0x141000.
2020-01-14 13:39:30,657 [root] DEBUG: Error 31 (0x1f) - ClearDebugRegister: Initial GetThreadContext failed: A device attached to the system is not functioning.
2020-01-14 13:39:30,859 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x140000-0x141000.
2020-01-14 13:39:31,328 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00140000 - 0x00141000.
2020-01-14 13:39:32,279 [root] DEBUG: ClearThreadBreakpoint: Call to ClearDebugRegister failed.
2020-01-14 13:39:32,279 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_203479493431391314212020 successfully created, size 0x10000
2020-01-14 13:39:32,388 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00140000.
2020-01-14 13:39:32,621 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x140000
2020-01-14 13:39:32,871 [root] DEBUG: DumpPEsInRange: Scanning range 0x140000 - 0x141000.
2020-01-14 13:39:32,996 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x140000-0x141000.
2020-01-14 13:39:33,776 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00140000 size 0x10000.
2020-01-14 13:39:33,776 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00140000 - 0x00141000.
2020-01-14 13:39:33,869 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_40653541733391314212020 successfully created, size 0x1000
2020-01-14 13:39:34,197 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_14290549233391314212020 successfully created, size 0x10000
2020-01-14 13:39:34,384 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x140000
2020-01-14 13:39:34,805 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_40653541733391314212020
2020-01-14 13:39:34,822 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00140000 size 0x10000.
2020-01-14 13:39:35,211 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_132474660035391314212020 successfully created, size 0x1000
2020-01-14 13:39:35,211 [root] DEBUG: DumpRegion: Dumped stack region from 0x00140000, size 0x1000.
2020-01-14 13:39:35,710 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00140000.
2020-01-14 13:39:36,023 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x140000 - 0x141000.
2020-01-14 13:39:36,444 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:39:36,476 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_132474660035391314212020
2020-01-14 13:39:37,145 [root] DEBUG: DumpPEsInRange: Scanning range 0x130000 - 0x131000.
2020-01-14 13:39:37,223 [root] DEBUG: DumpRegion: Dumped stack region from 0x00140000, size 0x1000.
2020-01-14 13:39:37,691 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00140000.
2020-01-14 13:39:38,207 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x140000 - 0x141000.
2020-01-14 13:39:38,207 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x130000-0x131000.
2020-01-14 13:39:38,471 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x00130000.
2020-01-14 13:39:38,878 [root] DEBUG: DumpPEsInRange: Scanning range 0x130000 - 0x131000.
2020-01-14 13:39:39,065 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00130000 - 0x00131000.
2020-01-14 13:39:39,392 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_15005589439391314212020 successfully created, size 0x10000
2020-01-14 13:39:39,720 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x130000
2020-01-14 13:39:39,720 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x130000-0x131000.
2020-01-14 13:39:40,141 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00130000 size 0x10000.
2020-01-14 13:39:40,173 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x00130000 - 0x00131000.
2020-01-14 13:39:40,655 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_123341532440391314212020 successfully created, size 0x1000
2020-01-14 13:39:40,905 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_62401705640391314212020 successfully created, size 0x10000
2020-01-14 13:39:41,592 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x130000
2020-01-14 13:39:41,920 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_123341532440391314212020
2020-01-14 13:39:41,920 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x00130000 size 0x10000.
2020-01-14 13:39:41,967 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_63360006441391314212020 successfully created, size 0x1000
2020-01-14 13:39:43,292 [root] DEBUG: DumpRegion: Dumped stack region from 0x00130000, size 0x1000.
2020-01-14 13:39:43,854 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00130000.
2020-01-14 13:39:43,963 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_63360006441391314212020
2020-01-14 13:39:44,243 [root] DEBUG: DumpRegion: Dumped stack region from 0x00130000, size 0x1000.
2020-01-14 13:39:46,194 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x130000 - 0x131000.
2020-01-14 13:39:46,194 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x00130000.
2020-01-14 13:39:46,210 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x130000 - 0x131000.
2020-01-14 13:39:46,256 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:39:46,256 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202F0000.
2020-01-14 13:39:46,256 [root] DEBUG: DumpPEsInRange: Scanning range 0x202f0000 - 0x202f1000.
2020-01-14 13:39:46,256 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x202f0000-0x202f1000.
2020-01-14 13:39:46,256 [root] DEBUG: DumpPEsInRange: Scanning range 0x202f0000 - 0x202f1000.
2020-01-14 13:39:46,288 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x202f0000-0x202f1000.
2020-01-14 13:39:46,584 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x202F0000 - 0x202F1000.
2020-01-14 13:39:46,584 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x202F0000 - 0x202F1000.
2020-01-14 13:39:46,772 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_24625000046391314212020 successfully created, size 0x40000
2020-01-14 13:39:47,115 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x202f0000
2020-01-14 13:39:47,115 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_210323386446391314212020 successfully created, size 0x40000
2020-01-14 13:39:47,240 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x202F0000 size 0x40000.
2020-01-14 13:39:47,411 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_186852531247391314212020 successfully created, size 0x2000
2020-01-14 13:39:50,203 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x202f0000
2020-01-14 13:39:50,203 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x202F0000 size 0x40000.
2020-01-14 13:39:50,219 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_186852531247391314212020
2020-01-14 13:39:50,219 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_46905767450391314212020 successfully created, size 0x2000
2020-01-14 13:39:50,234 [root] DEBUG: DumpRegion: Dumped stack region from 0x202F0000, size 0x2000.
2020-01-14 13:39:50,234 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_46905767450391314212020
2020-01-14 13:39:50,250 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x202F0000.
2020-01-14 13:39:50,250 [root] DEBUG: DumpRegion: Dumped stack region from 0x202F0000, size 0x2000.
2020-01-14 13:39:50,250 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x202F0000.
2020-01-14 13:39:50,250 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x202f0000 - 0x202f1000.
2020-01-14 13:39:50,266 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:39:50,437 [root] DEBUG: DumpPEsInRange: Scanning range 0x202e0000 - 0x202e1000.
2020-01-14 13:39:50,437 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x202f0000 - 0x202f1000.
2020-01-14 13:39:50,453 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x202e0000-0x202e1000.
2020-01-14 13:39:50,453 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x202E0000.
2020-01-14 13:39:50,453 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x202E0000 - 0x202E1000.
2020-01-14 13:39:50,516 [root] DEBUG: DumpPEsInRange: Scanning range 0x202e0000 - 0x202e1000.
2020-01-14 13:39:50,516 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_42731718450391314212020 successfully created, size 0x10000
2020-01-14 13:39:50,562 [root] DEBUG: ScanForDisguisedPE: No PE image located in range 0x202e0000-0x202e1000.
2020-01-14 13:39:50,562 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x202e0000
2020-01-14 13:39:50,733 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x202E0000 - 0x202E1000.
2020-01-14 13:39:50,828 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_10182015050391314212020 successfully created, size 0x10000
2020-01-14 13:39:51,497 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x202E0000 size 0x10000.
2020-01-14 13:39:51,497 [root] DEBUG: DumpMemory: Exception occured reading memory address 0x202e0000
2020-01-14 13:39:51,575 [root] DEBUG: DumpRegion: Failed to dump entire allocation from 0x202E0000 size 0x10000.
2020-01-14 13:39:51,717 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_179766172051391314212020 successfully created, size 0x2000
2020-01-14 13:39:51,732 [root] DEBUG: DumpMemory: CAPE output file C:\xObftrX\CAPE\2612_85723137651391314212020 successfully created, size 0x2000
2020-01-14 13:39:51,779 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_85723137651391314212020
2020-01-14 13:39:51,779 [root] INFO: Added new CAPE file to list with path: C:\xObftrX\CAPE\2612_179766172051391314212020
2020-01-14 13:39:51,825 [root] DEBUG: DumpRegion: Dumped stack region from 0x202E0000, size 0x2000.
2020-01-14 13:39:52,653 [root] DEBUG: DumpRegion: Dumped stack region from 0x202E0000, size 0x2000.
2020-01-14 13:39:52,653 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x202E0000.
2020-01-14 13:39:52,714 [root] DEBUG: ProcessTrackedRegion: dumped executable memory range at 0x202E0000.
2020-01-14 13:39:52,934 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x202e0000 - 0x202e1000.
2020-01-14 13:39:52,934 [root] DEBUG: ClearBreakpointsInRange: Clearing breakpoints in range 0x202e0000 - 0x202e1000.
2020-01-14 13:39:53,012 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:39:53,042 [root] DEBUG: DumpPEsInRange: Scanning range 0x7ef30000 - 0x7ef80000.
2020-01-14 13:39:53,042 [root] DEBUG: ProcessTrackedRegions: Processing region at 0x7EF30000.
2020-01-14 13:39:55,756 [root] DEBUG: ScanForDisguisedPE: Exception occured scanning buffer at 0x7ef30fc1
2020-01-14 13:39:56,163 [root] DEBUG: DumpPEsInTrackedRegion: No PE images found in range range 0x7EF30000 - 0x7EF80000.

MalScore

10.0

AgentTesla

Machine

Name Label Manager Started On Shutdown On
target-05 target-05 ESX 2020-01-14 13:35:34 2020-01-14 13:40:13

File Details

File Name T_C_FOR_.EXE
File Size 897024 bytes
File Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8e3509d1d6a6c7f8d66603060f5a6856
SHA1 947ddcad1a552172081d8c80af07a44fba110b3e
SHA256 dc432e8e621c3200012ddee28f065e87f3faaafd8472af265e42794bc5743e7b
SHA512 1994a47780a1b00ff0bf286933fc6b0f1396bb6d14b69b99d7543e76fdbf774f687e332bfe781041928a098bbeeb2f20e09580db0c54b915140a12dfb1d207fe
CRC32 2560D226
Ssdeep 12288:8mCC1/3Q3dQijOlnSpZxcDphwFe9kyK96I4svWmCol3:8ewOtWxcfwTv6I4s9C
TrID
  • 88.6% (.EXE) Win32 Executable Microsoft Visual Basic 6 (82067/2/8)
  • 4.8% (.EXE) Win32 Executable (generic) (4508/7/1)
  • 2.1% (.EXE) OS/2 Executable (generic) (2029/13)
  • 2.1% (.EXE) Generic Win/DOS Executable (2002/3)
  • 2.1% (.EXE) DOS Executable Generic (2000/1)
ClamAV None matched
Yara
  • shellcode_get_eip - Match x86 that appears to fetch $PC.
CAPE Yara None matched
Resubmit sample

Signatures

Behavioural detection: Executable code extraction
SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Hit: PID 0 trigged the Yara rule 'shellcode_get_eip'
Hit: PID 2124 trigged the Yara rule 'embedded_win_api'
Hit: PID 2124 trigged the Yara rule 'shellcode_patterns'
Hit: PID 2612 trigged the Yara rule 'AgentTesla'
NtSetInformationThread: attempt to hide thread from debugger
Possible date expiration check, exits too soon after checking local time
process: T_C_FOR_.EXE, PID 2124
Guard pages use detected - possible anti-debugging.
Detected script timer window indicative of sleep style evasion
Window: WSH-Timer
A process attempted to delay the analysis task.
Process: filename.exe tried to sleep 652 seconds, actually delayed analysis time by 0 seconds
Dynamic (imported) function loading detected
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: OLEAUT32.dll/OleLoadPictureEx
DynamicLoader: OLEAUT32.dll/DispCallFunc
DynamicLoader: OLEAUT32.dll/LoadTypeLibEx
DynamicLoader: OLEAUT32.dll/UnRegisterTypeLib
DynamicLoader: OLEAUT32.dll/CreateTypeLib2
DynamicLoader: OLEAUT32.dll/VarDateFromUdate
DynamicLoader: OLEAUT32.dll/VarUdateFromDate
DynamicLoader: OLEAUT32.dll/GetAltMonthNames
DynamicLoader: OLEAUT32.dll/VarNumFromParseNum
DynamicLoader: OLEAUT32.dll/VarParseNumFromStr
DynamicLoader: OLEAUT32.dll/VarDecFromR4
DynamicLoader: OLEAUT32.dll/VarDecFromR8
DynamicLoader: OLEAUT32.dll/VarDecFromDate
DynamicLoader: OLEAUT32.dll/VarDecFromI4
DynamicLoader: OLEAUT32.dll/VarDecFromCy
DynamicLoader: OLEAUT32.dll/VarR4FromDec
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromTypeInfo
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromGuids
DynamicLoader: OLEAUT32.dll/SafeArrayGetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArraySetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArrayGetIID
DynamicLoader: OLEAUT32.dll/SafeArraySetIID
DynamicLoader: OLEAUT32.dll/SafeArrayCopyData
DynamicLoader: OLEAUT32.dll/SafeArrayAllocDescriptorEx
DynamicLoader: OLEAUT32.dll/SafeArrayCreateEx
DynamicLoader: OLEAUT32.dll/VarFormat
DynamicLoader: OLEAUT32.dll/VarFormatDateTime
DynamicLoader: OLEAUT32.dll/VarFormatNumber
DynamicLoader: OLEAUT32.dll/VarFormatPercent
DynamicLoader: OLEAUT32.dll/VarFormatCurrency
DynamicLoader: OLEAUT32.dll/VarWeekdayName
DynamicLoader: OLEAUT32.dll/VarMonthName
DynamicLoader: OLEAUT32.dll/VarAdd
DynamicLoader: OLEAUT32.dll/VarAnd
DynamicLoader: OLEAUT32.dll/VarCat
DynamicLoader: OLEAUT32.dll/VarDiv
DynamicLoader: OLEAUT32.dll/VarEqv
DynamicLoader: OLEAUT32.dll/VarIdiv
DynamicLoader: OLEAUT32.dll/VarImp
DynamicLoader: OLEAUT32.dll/VarMod
DynamicLoader: OLEAUT32.dll/VarMul
DynamicLoader: OLEAUT32.dll/VarOr
DynamicLoader: OLEAUT32.dll/VarPow
DynamicLoader: OLEAUT32.dll/VarSub
DynamicLoader: OLEAUT32.dll/VarXor
DynamicLoader: OLEAUT32.dll/VarAbs
DynamicLoader: OLEAUT32.dll/VarFix
DynamicLoader: OLEAUT32.dll/VarInt
DynamicLoader: OLEAUT32.dll/VarNeg
DynamicLoader: OLEAUT32.dll/VarNot
DynamicLoader: OLEAUT32.dll/VarRound
DynamicLoader: OLEAUT32.dll/VarCmp
DynamicLoader: OLEAUT32.dll/VarDecAdd
DynamicLoader: OLEAUT32.dll/VarDecCmp
DynamicLoader: OLEAUT32.dll/VarBstrCat
DynamicLoader: OLEAUT32.dll/VarCyMulI4
DynamicLoader: OLEAUT32.dll/VarBstrCmp
DynamicLoader: ole32.dll/CoCreateInstanceEx
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: SXS.DLL/SxsOleAut32MapIIDOrCLSIDToTypeLibrary
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/MonitorFromWindow
DynamicLoader: USER32.dll/MonitorFromRect
DynamicLoader: USER32.dll/MonitorFromPoint
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: kernel32.dll/GetTickCount
DynamicLoader: kernel32.dll/Sleep
DynamicLoader: kernel32.dll/TerminateProcess
DynamicLoader: USER32.dll/EnumWindows
DynamicLoader: kernel32.dll/SetErrorMode
DynamicLoader: kernel32.dll/SetLastError
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: shell32.DLL/ShellExecuteW
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: kernel32.dll/VirtualProtectEx
DynamicLoader: kernel32.dll/CreateProcessInternalW
DynamicLoader: kernel32.dll/GetTempPathW
DynamicLoader: kernel32.dll/GetLongPathNameW
DynamicLoader: kernel32.dll/GetFileSize
DynamicLoader: kernel32.dll/ReadFile
DynamicLoader: kernel32.dll/ExitThread
DynamicLoader: kernel32.dll/GetCurrentThread
DynamicLoader: ntdll.dll/NtProtectVirtualMemory
DynamicLoader: ntdll.dll/DbgBreakPoint
DynamicLoader: ntdll.dll/DbgUiRemoteBreakin
DynamicLoader: ntdll.dll/NtSetInformationThread
DynamicLoader: ntdll.dll/NtAllocateVirtualMemory
DynamicLoader: ntdll.dll/NtGetContextThread
DynamicLoader: ntdll.dll/NtSetContextThread
DynamicLoader: shell32.DLL/SHCreateDirectoryExW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoGetApartmentType
DynamicLoader: ole32.dll/CoRegisterInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoGetMalloc
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/StringFromGUID2
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: ole32.dll/OleInitialize
DynamicLoader: PROPSYS.dll/PSCreateMemoryPropertyStore
DynamicLoader: PROPSYS.dll/PSPropertyBag_WriteDWORD
DynamicLoader: PROPSYS.dll/PSPropertyBag_ReadDWORD
DynamicLoader: PROPSYS.dll/PSPropertyBag_ReadBSTR
DynamicLoader: PROPSYS.dll/PSPropertyBag_ReadStrAlloc
DynamicLoader: shell32.DLL/
DynamicLoader: ADVAPI32.dll/OpenThreadToken
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ADVAPI32.dll/InitializeSecurityDescriptor
DynamicLoader: ADVAPI32.dll/SetEntriesInAclW
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: ADVAPI32.dll/SetSecurityDescriptorDacl
DynamicLoader: ADVAPI32.dll/IsTextUnicode
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: comctl32.dll/
DynamicLoader: sechost.dll/ConvertSidToStringSidW
DynamicLoader: profapi.dll/
DynamicLoader: PROPSYS.dll/
DynamicLoader: ole32.dll/PropVariantClear
DynamicLoader: OLEAUT32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_Size_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: SETUPAPI.dll/CM_Get_Device_Interface_List_ExW
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ADVAPI32.dll/RegQueryValueW
DynamicLoader: apphelp.dll/ApphelpCheckShellObject
DynamicLoader: PROPSYS.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegGetValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ole32.dll/CoTaskMemRealloc
DynamicLoader: PROPSYS.dll/InitPropVariantFromStringAsVector
DynamicLoader: PROPSYS.dll/PSCoerceToCanonicalValue
DynamicLoader: PROPSYS.dll/PropVariantToStringAlloc
DynamicLoader: ole32.dll/CoAllowSetForegroundWindow
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: kernel32.dll/InitializeSRWLock
DynamicLoader: kernel32.dll/AcquireSRWLockExclusive
DynamicLoader: kernel32.dll/AcquireSRWLockShared
DynamicLoader: kernel32.dll/ReleaseSRWLockExclusive
DynamicLoader: kernel32.dll/ReleaseSRWLockShared
DynamicLoader: shell32.DLL/SHGetFolderPathW
DynamicLoader: ADVAPI32.dll/SaferGetPolicyInformation
DynamicLoader: ntdll.dll/RtlDllShutdownInProgress
DynamicLoader: comctl32.dll/
DynamicLoader: ole32.dll/OleUninitialize
DynamicLoader: ole32.dll/CoRevokeInitializeSpy
DynamicLoader: comctl32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: kernel32.dll/HeapSetInformation
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: SXS.DLL/SxsOleAut32MapConfiguredClsidToReferenceClsid
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ADVAPI32.dll/SaferIdentifyLevel
DynamicLoader: ADVAPI32.dll/SaferComputeTokenFromLevel
DynamicLoader: ADVAPI32.dll/SaferCloseLevel
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: WScript.exe/
DynamicLoader: SXS.DLL/SxsOleAut32RedirectTypeLibrary
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: ADVAPI32.dll/RegQueryValueW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: kernel32.dll/IsTNT
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: OLEAUT32.dll/OleLoadPictureEx
DynamicLoader: OLEAUT32.dll/DispCallFunc
DynamicLoader: OLEAUT32.dll/LoadTypeLibEx
DynamicLoader: OLEAUT32.dll/UnRegisterTypeLib
DynamicLoader: OLEAUT32.dll/CreateTypeLib2
DynamicLoader: OLEAUT32.dll/VarDateFromUdate
DynamicLoader: OLEAUT32.dll/VarUdateFromDate
DynamicLoader: OLEAUT32.dll/GetAltMonthNames
DynamicLoader: OLEAUT32.dll/VarNumFromParseNum
DynamicLoader: OLEAUT32.dll/VarParseNumFromStr
DynamicLoader: OLEAUT32.dll/VarDecFromR4
DynamicLoader: OLEAUT32.dll/VarDecFromR8
DynamicLoader: OLEAUT32.dll/VarDecFromDate
DynamicLoader: OLEAUT32.dll/VarDecFromI4
DynamicLoader: OLEAUT32.dll/VarDecFromCy
DynamicLoader: OLEAUT32.dll/VarR4FromDec
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromTypeInfo
DynamicLoader: OLEAUT32.dll/GetRecordInfoFromGuids
DynamicLoader: OLEAUT32.dll/SafeArrayGetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArraySetRecordInfo
DynamicLoader: OLEAUT32.dll/SafeArrayGetIID
DynamicLoader: OLEAUT32.dll/SafeArraySetIID
DynamicLoader: OLEAUT32.dll/SafeArrayCopyData
DynamicLoader: OLEAUT32.dll/SafeArrayAllocDescriptorEx
DynamicLoader: OLEAUT32.dll/SafeArrayCreateEx
DynamicLoader: OLEAUT32.dll/VarFormat
DynamicLoader: OLEAUT32.dll/VarFormatDateTime
DynamicLoader: OLEAUT32.dll/VarFormatNumber
DynamicLoader: OLEAUT32.dll/VarFormatPercent
DynamicLoader: OLEAUT32.dll/VarFormatCurrency
DynamicLoader: OLEAUT32.dll/VarWeekdayName
DynamicLoader: OLEAUT32.dll/VarMonthName
DynamicLoader: OLEAUT32.dll/VarAdd
DynamicLoader: OLEAUT32.dll/VarAnd
DynamicLoader: OLEAUT32.dll/VarCat
DynamicLoader: OLEAUT32.dll/VarDiv
DynamicLoader: OLEAUT32.dll/VarEqv
DynamicLoader: OLEAUT32.dll/VarIdiv
DynamicLoader: OLEAUT32.dll/VarImp
DynamicLoader: OLEAUT32.dll/VarMod
DynamicLoader: OLEAUT32.dll/VarMul
DynamicLoader: OLEAUT32.dll/VarOr
DynamicLoader: OLEAUT32.dll/VarPow
DynamicLoader: OLEAUT32.dll/VarSub
DynamicLoader: OLEAUT32.dll/VarXor
DynamicLoader: OLEAUT32.dll/VarAbs
DynamicLoader: OLEAUT32.dll/VarFix
DynamicLoader: OLEAUT32.dll/VarInt
DynamicLoader: OLEAUT32.dll/VarNeg
DynamicLoader: OLEAUT32.dll/VarNot
DynamicLoader: OLEAUT32.dll/VarRound
DynamicLoader: OLEAUT32.dll/VarCmp
DynamicLoader: OLEAUT32.dll/VarDecAdd
DynamicLoader: OLEAUT32.dll/VarDecCmp
DynamicLoader: OLEAUT32.dll/VarBstrCat
DynamicLoader: OLEAUT32.dll/VarCyMulI4
DynamicLoader: OLEAUT32.dll/VarBstrCmp
DynamicLoader: ole32.dll/CoCreateInstanceEx
DynamicLoader: ole32.dll/CLSIDFromProgIDEx
DynamicLoader: SXS.DLL/SxsOleAut32MapIIDOrCLSIDToTypeLibrary
DynamicLoader: USER32.dll/GetSystemMetrics
DynamicLoader: USER32.dll/MonitorFromWindow
DynamicLoader: USER32.dll/MonitorFromRect
DynamicLoader: USER32.dll/MonitorFromPoint
DynamicLoader: USER32.dll/EnumDisplayMonitors
DynamicLoader: USER32.dll/GetMonitorInfoA
DynamicLoader: kernel32.dll/GetTickCount
DynamicLoader: kernel32.dll/Sleep
DynamicLoader: kernel32.dll/TerminateProcess
DynamicLoader: USER32.dll/EnumWindows
DynamicLoader: kernel32.dll/SetErrorMode
DynamicLoader: kernel32.dll/SetLastError
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: shell32.DLL/ShellExecuteW
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: kernel32.dll/VirtualProtectEx
DynamicLoader: kernel32.dll/CreateProcessInternalW
DynamicLoader: kernel32.dll/GetTempPathW
DynamicLoader: kernel32.dll/GetLongPathNameW
DynamicLoader: kernel32.dll/GetFileSize
DynamicLoader: kernel32.dll/ReadFile
DynamicLoader: kernel32.dll/ExitThread
DynamicLoader: kernel32.dll/GetCurrentThread
DynamicLoader: ntdll.dll/NtProtectVirtualMemory
DynamicLoader: ntdll.dll/DbgBreakPoint
DynamicLoader: ntdll.dll/DbgUiRemoteBreakin
DynamicLoader: ntdll.dll/NtSetInformationThread
DynamicLoader: ntdll.dll/NtAllocateVirtualMemory
DynamicLoader: ntdll.dll/NtGetContextThread
DynamicLoader: ntdll.dll/NtSetContextThread
DynamicLoader: USER32.dll/GetCursorPos
DynamicLoader: ntdll.dll/NtResumeThread
DynamicLoader: kernel32.dll/GetExitCodeProcess
DynamicLoader: kernel32.dll/IsTNT
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: kernel32.dll/GetTickCount
DynamicLoader: kernel32.dll/Sleep
DynamicLoader: kernel32.dll/TerminateProcess
DynamicLoader: USER32.dll/EnumWindows
DynamicLoader: kernel32.dll/SetErrorMode
DynamicLoader: kernel32.dll/SetLastError
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: shell32.DLL/ShellExecuteW
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: kernel32.dll/VirtualProtectEx
DynamicLoader: kernel32.dll/CreateProcessInternalW
DynamicLoader: kernel32.dll/GetTempPathW
DynamicLoader: kernel32.dll/GetLongPathNameW
DynamicLoader: kernel32.dll/GetFileSize
DynamicLoader: kernel32.dll/ReadFile
DynamicLoader: kernel32.dll/ExitThread
DynamicLoader: kernel32.dll/GetCurrentThread
DynamicLoader: ntdll.dll/NtProtectVirtualMemory
DynamicLoader: ntdll.dll/DbgBreakPoint
DynamicLoader: ntdll.dll/DbgUiRemoteBreakin
DynamicLoader: ntdll.dll/NtSetInformationThread
DynamicLoader: ntdll.dll/NtAllocateVirtualMemory
DynamicLoader: ntdll.dll/NtGetContextThread
DynamicLoader: ntdll.dll/NtSetContextThread
DynamicLoader: kernel32.dll/GetStartupInfoW
DynamicLoader: kernel32.dll/RaiseException
DynamicLoader: kernel32.dll/GetLastError
DynamicLoader: kernel32.dll/IsBadReadPtr
DynamicLoader: kernel32.dll/VirtualProtect
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/MultiByteToWideChar
DynamicLoader: kernel32.dll/lstrlenA
DynamicLoader: kernel32.dll/WideCharToMultiByte
DynamicLoader: kernel32.dll/lstrlenW
DynamicLoader: kernel32.dll/GetModuleFileNameW
DynamicLoader: kernel32.dll/GetModuleFileNameA
DynamicLoader: kernel32.dll/LoadLibraryA
DynamicLoader: kernel32.dll/FreeResource
DynamicLoader: kernel32.dll/SizeofResource
DynamicLoader: kernel32.dll/LockResource
DynamicLoader: kernel32.dll/LoadResource
DynamicLoader: kernel32.dll/FindResourceA
DynamicLoader: kernel32.dll/Module32Next
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: kernel32.dll/Module32First
DynamicLoader: kernel32.dll/CreateToolhelp32Snapshot
DynamicLoader: kernel32.dll/GetCurrentProcessId
DynamicLoader: kernel32.dll/CreateFileA
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: kernel32.dll/GetModuleHandleW
DynamicLoader: kernel32.dll/VirtualAlloc
DynamicLoader: kernel32.dll/VirtualFree
DynamicLoader: kernel32.dll/HeapFree
DynamicLoader: kernel32.dll/GetProcessHeap
DynamicLoader: kernel32.dll/FreeLibrary
DynamicLoader: kernel32.dll/HeapAlloc
DynamicLoader: kernel32.dll/HeapReAlloc
DynamicLoader: kernel32.dll/GetCommandLineA
DynamicLoader: kernel32.dll/DeleteCriticalSection
DynamicLoader: kernel32.dll/LeaveCriticalSection
DynamicLoader: kernel32.dll/EnterCriticalSection
DynamicLoader: kernel32.dll/HeapCreate
DynamicLoader: kernel32.dll/Sleep
DynamicLoader: kernel32.dll/ExitProcess
DynamicLoader: kernel32.dll/WriteFile
DynamicLoader: kernel32.dll/GetStdHandle
DynamicLoader: kernel32.dll/HeapSize
DynamicLoader: kernel32.dll/TerminateProcess
DynamicLoader: kernel32.dll/GetCurrentProcess
DynamicLoader: kernel32.dll/UnhandledExceptionFilter
DynamicLoader: kernel32.dll/SetUnhandledExceptionFilter
DynamicLoader: kernel32.dll/IsDebuggerPresent
DynamicLoader: kernel32.dll/GetConsoleCP
DynamicLoader: kernel32.dll/GetConsoleMode
DynamicLoader: kernel32.dll/ReadFile
DynamicLoader: kernel32.dll/TlsGetValue
DynamicLoader: kernel32.dll/TlsAlloc
DynamicLoader: kernel32.dll/TlsSetValue
DynamicLoader: kernel32.dll/TlsFree
DynamicLoader: kernel32.dll/InterlockedIncrement
DynamicLoader: kernel32.dll/SetLastError
DynamicLoader: kernel32.dll/GetCurrentThreadId
DynamicLoader: kernel32.dll/InterlockedDecrement
DynamicLoader: kernel32.dll/FlushFileBuffers
DynamicLoader: kernel32.dll/SetFilePointer
DynamicLoader: kernel32.dll/SetHandleCount
DynamicLoader: kernel32.dll/GetFileType
DynamicLoader: kernel32.dll/GetStartupInfoA
DynamicLoader: kernel32.dll/RtlUnwind
DynamicLoader: kernel32.dll/FreeEnvironmentStringsA
DynamicLoader: kernel32.dll/GetEnvironmentStrings
DynamicLoader: kernel32.dll/FreeEnvironmentStringsW
DynamicLoader: kernel32.dll/GetEnvironmentStringsW
DynamicLoader: kernel32.dll/QueryPerformanceCounter
DynamicLoader: kernel32.dll/GetTickCount
DynamicLoader: kernel32.dll/GetSystemTimeAsFileTime
DynamicLoader: kernel32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: kernel32.dll/GetCPInfo
DynamicLoader: kernel32.dll/GetACP
DynamicLoader: kernel32.dll/GetOEMCP
DynamicLoader: kernel32.dll/IsValidCodePage
DynamicLoader: kernel32.dll/CompareStringA
DynamicLoader: kernel32.dll/CompareStringW
DynamicLoader: kernel32.dll/SetEnvironmentVariableA
DynamicLoader: kernel32.dll/WriteConsoleA
DynamicLoader: kernel32.dll/GetConsoleOutputCP
DynamicLoader: kernel32.dll/WriteConsoleW
DynamicLoader: kernel32.dll/SetStdHandle
DynamicLoader: kernel32.dll/GetLocaleInfoA
DynamicLoader: kernel32.dll/LCMapStringA
DynamicLoader: kernel32.dll/LCMapStringW
DynamicLoader: kernel32.dll/GetStringTypeA
DynamicLoader: kernel32.dll/GetStringTypeW
DynamicLoader: kernel32.dll/SetEndOfFile
DynamicLoader: kernel32.dll/CreateThread
DynamicLoader: kernel32.dll/GetCurrentThread
DynamicLoader: kernel32.dll/TerminateThread
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: mscoree.dll/_CorExeMain
DynamicLoader: mscoree.dll/CLRCreateInstance
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryInfoKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyExW
DynamicLoader: ADVAPI32.dll/RegEnumValueW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: mscoree.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: mscoreei.dll/RegisterShimImplCallback
DynamicLoader: mscoreei.dll/RegisterShimImplCleanupCallback
DynamicLoader: mscoreei.dll/SetShellShimInstance
DynamicLoader: mscoreei.dll/OnShimDllMainCalled
DynamicLoader: mscoreei.dll/CLRCreateInstance
DynamicLoader: kernel32.dll/GetModuleFileNameW
DynamicLoader: kernel32.dll/GetModuleFileNameA
DynamicLoader: kernel32.dll/GetModuleHandleW
DynamicLoader: kernel32.dll/GetModuleHandleA
DynamicLoader: kernel32.dll/CreateFileA
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: mscoreei.dll/_CorExeMain_RetAddr
DynamicLoader: mscoreei.dll/_CorExeMain
DynamicLoader: SHLWAPI.dll/UrlIsW
DynamicLoader: kernel32.dll/GetCurrentPackageId
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/InitializeCriticalSectionAndSpinCount
DynamicLoader: kernel32.dll/IsProcessorFeaturePresent
DynamicLoader: msvcrt.dll/_set_error_mode
DynamicLoader: msvcrt.dll/?set_terminate@@YAP6AXXZP6AXXZ@Z
DynamicLoader: msvcrt.dll/_get_terminate
DynamicLoader: kernel32.dll/FindActCtxSectionStringW
DynamicLoader: kernel32.dll/GetSystemWindowsDirectoryW
DynamicLoader: mscoree.dll/GetProcessExecutableHeap
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap_RetAddr
DynamicLoader: mscoreei.dll/GetProcessExecutableHeap
DynamicLoader: mscorwks.dll/SetLoadedByMscoree
DynamicLoader: mscorwks.dll/_CorExeMain
DynamicLoader: mscorwks.dll/GetCLRFunction
DynamicLoader: ADVAPI32.dll/RegisterTraceGuidsW
DynamicLoader: ADVAPI32.dll/UnregisterTraceGuids
DynamicLoader: ADVAPI32.dll/GetTraceLoggerHandle
DynamicLoader: ADVAPI32.dll/GetTraceEnableLevel
DynamicLoader: ADVAPI32.dll/GetTraceEnableFlags
DynamicLoader: ADVAPI32.dll/TraceEvent
DynamicLoader: mscoree.dll/IEE
DynamicLoader: mscoreei.dll/IEE_RetAddr
DynamicLoader: mscoreei.dll/IEE
DynamicLoader: mscorwks.dll/IEE
DynamicLoader: mscoree.dll/GetStartupFlags
DynamicLoader: mscoreei.dll/GetStartupFlags_RetAddr
DynamicLoader: mscoreei.dll/GetStartupFlags
DynamicLoader: mscoree.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetHostConfigurationFile_RetAddr
DynamicLoader: mscoreei.dll/GetHostConfigurationFile
DynamicLoader: mscoreei.dll/GetCORVersion_RetAddr
DynamicLoader: mscoreei.dll/GetCORVersion
DynamicLoader: mscoree.dll/GetCORSystemDirectory
DynamicLoader: mscoreei.dll/GetCORSystemDirectory_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream_RetAddr
DynamicLoader: mscoreei.dll/CreateConfigStream
DynamicLoader: ntdll.dll/RtlUnwind
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: kernel32.dll/GetSystemWindowsDirectoryW
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: ADVAPI32.dll/AllocateAndInitializeSid
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/GetTokenInformation
DynamicLoader: ADVAPI32.dll/InitializeAcl
DynamicLoader: ADVAPI32.dll/AddAccessAllowedAce
DynamicLoader: ADVAPI32.dll/FreeSid
DynamicLoader: kernel32.dll/SetThreadStackGuarantee
DynamicLoader: kernel32.dll/FlsSetValue
DynamicLoader: kernel32.dll/FlsGetValue
DynamicLoader: kernel32.dll/FlsAlloc
DynamicLoader: kernel32.dll/FlsFree
DynamicLoader: kernel32.dll/AddVectoredContinueHandler
DynamicLoader: kernel32.dll/RemoveVectoredContinueHandler
DynamicLoader: ADVAPI32.dll/ConvertSidToStringSidW
DynamicLoader: shell32.DLL/SHGetFolderPathW
DynamicLoader: kernel32.dll/FlushProcessWriteBuffers
DynamicLoader: kernel32.dll/GetWriteWatch
DynamicLoader: kernel32.dll/ResetWriteWatch
DynamicLoader: kernel32.dll/CreateMemoryResourceNotification
DynamicLoader: kernel32.dll/QueryMemoryResourceNotification
DynamicLoader: mscoree.dll/_CorExeMain
DynamicLoader: mscoree.dll/_CorImageUnloading
DynamicLoader: mscoree.dll/_CorValidateImage
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: kernel32.dll/QueryActCtxW
DynamicLoader: ole32.dll/CoGetContextToken
DynamicLoader: kernel32.dll/GetVersionEx
DynamicLoader: kernel32.dll/GetVersionExW
DynamicLoader: kernel32.dll/GetVersionEx
DynamicLoader: kernel32.dll/GetVersionExW
DynamicLoader: kernel32.dll/GetFullPathName
DynamicLoader: kernel32.dll/GetFullPathNameW
DynamicLoader: ADVAPI32.dll/CryptAcquireContextA
DynamicLoader: ADVAPI32.dll/CryptReleaseContext
DynamicLoader: ADVAPI32.dll/CryptCreateHash
DynamicLoader: ADVAPI32.dll/CryptDestroyHash
DynamicLoader: ADVAPI32.dll/CryptHashData
DynamicLoader: ADVAPI32.dll/CryptGetHashParam
DynamicLoader: ADVAPI32.dll/CryptImportKey
DynamicLoader: ADVAPI32.dll/CryptExportKey
DynamicLoader: ADVAPI32.dll/CryptGenKey
DynamicLoader: ADVAPI32.dll/CryptGetKeyParam
DynamicLoader: ADVAPI32.dll/CryptDestroyKey
DynamicLoader: ADVAPI32.dll/CryptVerifySignatureA
DynamicLoader: ADVAPI32.dll/CryptSignHashA
DynamicLoader: ADVAPI32.dll/CryptGetProvParam
DynamicLoader: ADVAPI32.dll/CryptGetUserKey
DynamicLoader: ADVAPI32.dll/CryptEnumProvidersA
DynamicLoader: CRYPTSP.dll/CryptAcquireContextA
DynamicLoader: CRYPTSP.dll/CryptImportKey
DynamicLoader: CRYPTSP.dll/CryptExportKey
DynamicLoader: CRYPTSP.dll/CryptCreateHash
DynamicLoader: CRYPTSP.dll/CryptHashData
DynamicLoader: CRYPTSP.dll/CryptGetHashParam
DynamicLoader: CRYPTSP.dll/CryptDestroyHash
DynamicLoader: CRYPTSP.dll/CryptDestroyKey
DynamicLoader: mscorjit.dll/getJit
DynamicLoader: kernel32.dll/IsWow64Process
DynamicLoader: kernel32.dll/lstrlen
DynamicLoader: kernel32.dll/lstrlenW
DynamicLoader: ADVAPI32.dll/RegCloseKey
DynamicLoader: kernel32.dll/GetUserDefaultUILanguage
DynamicLoader: bcrypt.dll/BCryptGetFipsAlgorithmMode
DynamicLoader: kernel32.dll/SetErrorMode
DynamicLoader: kernel32.dll/GetFileAttributesEx
DynamicLoader: kernel32.dll/GetFileAttributesExW
DynamicLoader: ADVAPI32.dll/RegOpenKeyEx
DynamicLoader: ADVAPI32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: ADVAPI32.dll/RegQueryValueEx
DynamicLoader: ADVAPI32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/GetModuleHandle
DynamicLoader: kernel32.dll/GetModuleHandleW
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: USER32.dll/DefWindowProcW
DynamicLoader: GDI32.dll/GetStockObject
DynamicLoader: USER32.dll/RegisterClass
DynamicLoader: USER32.dll/RegisterClassW
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: USER32.dll/CreateWindowEx
DynamicLoader: USER32.dll/CreateWindowExW
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/GetWindowLong
DynamicLoader: USER32.dll/GetWindowLongW
DynamicLoader: kernel32.dll/GetCurrentProcess
DynamicLoader: kernel32.dll/GetCurrentThread
DynamicLoader: kernel32.dll/DuplicateHandle
DynamicLoader: kernel32.dll/GetCurrentThreadId
DynamicLoader: USER32.dll/SetWindowLong
DynamicLoader: USER32.dll/SetWindowLongW
DynamicLoader: USER32.dll/CallWindowProc
DynamicLoader: USER32.dll/CallWindowProcW
DynamicLoader: USER32.dll/RegisterWindowMessage
DynamicLoader: USER32.dll/RegisterWindowMessageW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: ole32.dll/CreateBindCtx
DynamicLoader: ole32.dll/CoGetObjectContext
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: ole32.dll/NdrOleInitializeExtension
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/MkParseDisplayName
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: kernel32.dll/GetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/SetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/LocaleNameToLCID
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCIDToLocaleName
DynamicLoader: kernel32.dll/GetSystemDefaultLocaleName
DynamicLoader: ole32.dll/BindMoniker
DynamicLoader: SXS.DLL/SxsOleAut32RedirectTypeLibrary
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: ADVAPI32.dll/RegEnumKeyW
DynamicLoader: ADVAPI32.dll/RegQueryValueW
DynamicLoader: SXS.DLL/SxsOleAut32MapConfiguredClsidToReferenceClsid
DynamicLoader: SXS.DLL/SxsLookupClrGuid
DynamicLoader: kernel32.dll/ReleaseActCtx
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: mscoreei.dll/_CorDllMain_RetAddr
DynamicLoader: mscoreei.dll/_CorDllMain
DynamicLoader: mscoree.dll/GetTokenForVTableEntry
DynamicLoader: mscoree.dll/SetTargetForVTableEntry
DynamicLoader: mscoree.dll/GetTargetForVTableEntry
DynamicLoader: mscoreei.dll/GetTokenForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/GetTokenForVTableEntry
DynamicLoader: mscoreei.dll/SetTargetForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/SetTargetForVTableEntry
DynamicLoader: mscoreei.dll/GetTargetForVTableEntry_RetAddr
DynamicLoader: mscoreei.dll/GetTargetForVTableEntry
DynamicLoader: kernel32.dll/GetLastError
DynamicLoader: kernel32.dll/LocalAlloc
DynamicLoader: OLEAUT32.dll/VariantInit
DynamicLoader: OLEAUT32.dll/VariantClear
DynamicLoader: OLEAUT32.dll/
DynamicLoader: kernel32.dll/CreateEvent
DynamicLoader: kernel32.dll/CreateEventW
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: kernel32.dll/SwitchToThread
DynamicLoader: kernel32.dll/SetEvent
DynamicLoader: ole32.dll/CoWaitForMultipleHandles
DynamicLoader: ole32.dll/IIDFromString
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: kernel32.dll/LoadLibrary
DynamicLoader: kernel32.dll/LoadLibraryA
DynamicLoader: kernel32.dll/GetProcAddress
DynamicLoader: wminet_utils.dll/ResetSecurity
DynamicLoader: wminet_utils.dll/SetSecurity
DynamicLoader: wminet_utils.dll/BlessIWbemServices
DynamicLoader: wminet_utils.dll/BlessIWbemServicesObject
DynamicLoader: wminet_utils.dll/GetPropertyHandle
DynamicLoader: wminet_utils.dll/WritePropertyValue
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/VerifyClientKey
DynamicLoader: wminet_utils.dll/GetQualifierSet
DynamicLoader: wminet_utils.dll/Get
DynamicLoader: wminet_utils.dll/Put
DynamicLoader: wminet_utils.dll/Delete
DynamicLoader: wminet_utils.dll/GetNames
DynamicLoader: wminet_utils.dll/BeginEnumeration
DynamicLoader: wminet_utils.dll/Next
DynamicLoader: wminet_utils.dll/EndEnumeration
DynamicLoader: wminet_utils.dll/GetPropertyQualifierSet
DynamicLoader: wminet_utils.dll/Clone
DynamicLoader: wminet_utils.dll/GetObjectText
DynamicLoader: wminet_utils.dll/SpawnDerivedClass
DynamicLoader: wminet_utils.dll/SpawnInstance
DynamicLoader: wminet_utils.dll/CompareTo
DynamicLoader: wminet_utils.dll/GetPropertyOrigin
DynamicLoader: wminet_utils.dll/InheritsFrom
DynamicLoader: wminet_utils.dll/GetMethod
DynamicLoader: wminet_utils.dll/PutMethod
DynamicLoader: wminet_utils.dll/DeleteMethod
DynamicLoader: wminet_utils.dll/BeginMethodEnumeration
DynamicLoader: wminet_utils.dll/NextMethod
DynamicLoader: wminet_utils.dll/EndMethodEnumeration
DynamicLoader: wminet_utils.dll/GetMethodQualifierSet
DynamicLoader: wminet_utils.dll/GetMethodOrigin
DynamicLoader: wminet_utils.dll/QualifierSet_Get
DynamicLoader: wminet_utils.dll/QualifierSet_Put
DynamicLoader: wminet_utils.dll/QualifierSet_Delete
DynamicLoader: wminet_utils.dll/QualifierSet_GetNames
DynamicLoader: wminet_utils.dll/QualifierSet_BeginEnumeration
DynamicLoader: wminet_utils.dll/QualifierSet_Next
DynamicLoader: wminet_utils.dll/QualifierSet_EndEnumeration
DynamicLoader: wminet_utils.dll/GetCurrentApartmentType
DynamicLoader: wminet_utils.dll/GetDemultiplexedStub
DynamicLoader: wminet_utils.dll/CreateInstanceEnumWmi
DynamicLoader: wminet_utils.dll/CreateClassEnumWmi
DynamicLoader: wminet_utils.dll/ExecQueryWmi
DynamicLoader: wminet_utils.dll/ExecNotificationQueryWmi
DynamicLoader: wminet_utils.dll/PutInstanceWmi
DynamicLoader: wminet_utils.dll/PutClassWmi
DynamicLoader: wminet_utils.dll/CloneEnumWbemClassObject
DynamicLoader: wminet_utils.dll/ConnectServerWmi
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: OLEAUT32.dll/SysStringLen
DynamicLoader: kernel32.dll/ZeroMemory
DynamicLoader: kernel32.dll/ZeroMemoryA
DynamicLoader: kernel32.dll/RtlZeroMemory
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: ADVAPI32.dll/GetUserName
DynamicLoader: ADVAPI32.dll/GetUserNameW
DynamicLoader: kernel32.dll/GetComputerName
DynamicLoader: kernel32.dll/GetComputerNameW
DynamicLoader: kernel32.dll/GetEnvironmentVariable
DynamicLoader: kernel32.dll/GetEnvironmentVariableW
DynamicLoader: kernel32.dll/GetCurrentProcessId
DynamicLoader: kernel32.dll/GetCurrentProcessIdW
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValue
DynamicLoader: ADVAPI32.dll/LookupPrivilegeValueW
DynamicLoader: kernel32.dll/GetCurrentProcess
DynamicLoader: ADVAPI32.dll/OpenProcessToken
DynamicLoader: ADVAPI32.dll/OpenProcessTokenW
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivileges
DynamicLoader: ADVAPI32.dll/AdjustTokenPrivilegesW
DynamicLoader: kernel32.dll/CloseHandle
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtQuerySystemInformationW
DynamicLoader: kernel32.dll/CreateIoCompletionPort
DynamicLoader: kernel32.dll/PostQueuedCompletionStatus
DynamicLoader: ntdll.dll/NtQueryInformationThread
DynamicLoader: ntdll.dll/NtQuerySystemInformation
DynamicLoader: ntdll.dll/NtGetCurrentProcessorNumber
DynamicLoader: kernel32.dll/GetSystemTimeAsFileTime
DynamicLoader: USER32.dll/GetLastInputInfo
DynamicLoader: shfolder.dll/SHGetFolderPath
DynamicLoader: shfolder.dll/SHGetFolderPathW
DynamicLoader: kernel32.dll/CreateFile
DynamicLoader: kernel32.dll/CreateFileW
DynamicLoader: mscoreei.dll/LoadLibraryShim_RetAddr
DynamicLoader: mscoreei.dll/LoadLibraryShim
DynamicLoader: culture.dll/ConvertLangIdToCultureName
DynamicLoader: MLANG.dll/
DynamicLoader: WININET.dll/FindFirstUrlCacheEntryA
DynamicLoader: kernel32.dll/SetFileInformationByHandle
DynamicLoader: shell32.DLL/SHGetFolderPathW
DynamicLoader: vaultcli.dll/VaultEnumerateVaults
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: VSSAPI.DLL/CreateWriter
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ADVAPI32.dll/LookupAccountNameW
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: samcli.dll/NetLocalGroupGetMembers
DynamicLoader: SAMLIB.dll/SamConnect
DynamicLoader: RPCRT4.dll/NdrClientCall3
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: SAMLIB.dll/SamOpenDomain
DynamicLoader: SAMLIB.dll/SamLookupNamesInDomain
DynamicLoader: SAMLIB.dll/SamOpenAlias
DynamicLoader: SAMLIB.dll/SamFreeMemory
DynamicLoader: SAMLIB.dll/SamCloseHandle
DynamicLoader: SAMLIB.dll/SamGetMembersInAlias
DynamicLoader: netutils.dll/NetApiBufferFree
DynamicLoader: SAMLIB.dll/SamEnumerateDomainsInSamServer
DynamicLoader: SAMLIB.dll/SamLookupDomainInSamServer
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/StringFromCLSID
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: PROPSYS.dll/VariantToPropVariant
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: wbemsvc.dll/DllGetClassObject
DynamicLoader: wbemsvc.dll/DllCanUnloadNow
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeObjectAccessAuditEvent2
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeAuditEvent
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: RPCRT4.dll/NdrClientCall3
DynamicLoader: RPCRT4.dll/RpcBindingCreateW
DynamicLoader: RPCRT4.dll/RpcBindingBind
DynamicLoader: RPCRT4.dll/I_RpcMapWin32Status
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ADVAPI32.dll/EventRegister
DynamicLoader: ADVAPI32.dll/EventUnregister
DynamicLoader: ADVAPI32.dll/EventWrite
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: kernel32.dll/RegSetValueExW
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: wmisvc.dll/IsImproperShutdownDetected
DynamicLoader: Wevtapi.dll/EvtRender
DynamicLoader: Wevtapi.dll/EvtNext
DynamicLoader: Wevtapi.dll/EvtClose
DynamicLoader: Wevtapi.dll/EvtQuery
DynamicLoader: Wevtapi.dll/EvtCreateRenderContext
DynamicLoader: RPCRT4.dll/RpcStringBindingComposeW
DynamicLoader: RPCRT4.dll/RpcBindingFromStringBindingW
DynamicLoader: RPCRT4.dll/RpcBindingSetAuthInfoExW
DynamicLoader: RPCRT4.dll/RpcBindingSetOption
DynamicLoader: RPCRT4.dll/RpcStringFreeW
DynamicLoader: RPCRT4.dll/NdrClientCall3
DynamicLoader: RPCRT4.dll/RpcBindingFree
DynamicLoader: ole32.dll/CoCreateFreeThreadedMarshaler
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CreateStreamOnHGlobal
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ADVAPI32.dll/RegCreateKeyExW
DynamicLoader: ADVAPI32.dll/RegSetValueExW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: CRYPTSP.dll/CryptReleaseContext
DynamicLoader: KERNELBASE.dll/InitializeAcl
DynamicLoader: KERNELBASE.dll/AddAce
DynamicLoader: sechost.dll/ConvertStringSecurityDescriptorToSecurityDescriptorW
DynamicLoader: kernel32.dll/IsThreadAFiber
DynamicLoader: kernel32.dll/OpenProcessToken
DynamicLoader: KERNELBASE.dll/GetTokenInformation
DynamicLoader: KERNELBASE.dll/DuplicateTokenEx
DynamicLoader: KERNELBASE.dll/AdjustTokenPrivileges
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: KERNELBASE.dll/AllocateAndInitializeSid
DynamicLoader: KERNELBASE.dll/CheckTokenMembership
DynamicLoader: kernel32.dll/SetThreadToken
DynamicLoader: ole32.dll/CLSIDFromString
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzInitializeResourceManager
DynamicLoader: authZ.dll/AuthzInitializeContextFromSid
DynamicLoader: authZ.dll/AuthzInitializeContextFromToken
DynamicLoader: authZ.dll/AuthzAccessCheck
DynamicLoader: authZ.dll/AuthzFreeContext
DynamicLoader: authZ.dll/AuthzFreeResourceManager
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: ole32.dll/CoRevertToSelf
DynamicLoader: ADVAPI32.dll/LogonUserExExW
DynamicLoader: SspiCli.dll/LogonUserExExW
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetCallContext
DynamicLoader: ole32.dll/CoImpersonateClient
DynamicLoader: ADVAPI32.dll/OpenThreadToken
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoSwitchCallContext
DynamicLoader: ole32.dll/CoCreateGuid
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: sechost.dll/ConvertStringSecurityDescriptorToSecurityDescriptorW
DynamicLoader: sechost.dll/ConvertStringSecurityDescriptorToSecurityDescriptorW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: ole32.dll/CoInitializeEx
DynamicLoader: ole32.dll/CoUninitialize
DynamicLoader: wbemcore.dll/Reinitialize
DynamicLoader: kernel32.dll/RegCreateKeyExW
DynamicLoader: ntdll.dll/EtwRegisterTraceGuidsW
DynamicLoader: ntdll.dll/EtwRegisterTraceGuidsW
DynamicLoader: kernel32.dll/SortGetHandle
DynamicLoader: kernel32.dll/SortCloseHandle
DynamicLoader: CRYPTBASE.dll/SystemFunction036
DynamicLoader: ntmarta.dll/GetMartaExtensionInterface
DynamicLoader: sechost.dll/LookupAccountNameLocalW
DynamicLoader: ADVAPI32.dll/LookupAccountSidW
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: CRYPTSP.dll/CryptAcquireContextW
DynamicLoader: CRYPTSP.dll/CryptGenRandom
DynamicLoader: RpcRtRemote.dll/I_RpcExtInitializeExtensionPoint
DynamicLoader: ole32.dll/CoGetClassObject
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/StringFromIID
DynamicLoader: ole32.dll/CoGetPSClsid
DynamicLoader: ole32.dll/CoTaskMemAlloc
DynamicLoader: ole32.dll/CoTaskMemFree
DynamicLoader: ole32.dll/CoCreateInstance
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: ole32.dll/DcomChannelSetHResult
DynamicLoader: ole32.dll/CoGetMarshalSizeMax
DynamicLoader: ole32.dll/CoMarshalInterface
DynamicLoader: ole32.dll/CoUnmarshalInterface
DynamicLoader: ole32.dll/CoReleaseMarshalData
DynamicLoader: wbemsvc.dll/DllGetClassObject
DynamicLoader: wbemsvc.dll/DllCanUnloadNow
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: kernel32.dll/RegOpenKeyExW
DynamicLoader: kernel32.dll/RegQueryValueExW
DynamicLoader: kernel32.dll/RegCloseKey
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: sechost.dll/LookupAccountSidLocalW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: ADVAPI32.dll/RegOpenKeyW
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: OLEAUT32.dll/
DynamicLoader: kernel32.dll/GetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/SetThreadPreferredUILanguages
DynamicLoader: kernel32.dll/LocaleNameToLCID
DynamicLoader: kernel32.dll/GetLocaleInfoEx
DynamicLoader: kernel32.dll/LCIDToLocaleName
DynamicLoader: kernel32.dll/GetSystemDefaultLocaleName
DynamicLoader: WMI.DLL/WmiQueryAllDataW
DynamicLoader: WMI.DLL/WmiQuerySingleInstanceW
DynamicLoader: WMI.DLL/WmiSetSingleItemW
DynamicLoader: WMI.DLL/WmiSetSingleInstanceW
DynamicLoader: WMI.DLL/WmiExecuteMethodW
DynamicLoader: WMI.DLL/WmiNotificationRegistrationW
DynamicLoader: WMI.DLL/WmiMofEnumerateResourcesW
DynamicLoader: WMI.DLL/WmiFileHandleToInstanceNameW
DynamicLoader: WMI.DLL/WmiDevInstToInstanceNameW
DynamicLoader: WMI.DLL/WmiQueryGuidInformation
DynamicLoader: WMI.DLL/WmiOpenBlock
DynamicLoader: WMI.DLL/WmiCloseBlock
DynamicLoader: WMI.DLL/WmiFreeBuffer
DynamicLoader: WMI.DLL/WmiEnumerateGuids
DynamicLoader: OLEAUT32.dll/
Reads data out of its own binary image
self_read: process: T_C_FOR_.EXE, pid: 2124, offset: 0x00000000, length: 0x000db000
self_read: process: wscript.exe, pid: 2408, offset: 0x00000000, length: 0x00000040
self_read: process: wscript.exe, pid: 2408, offset: 0x000000f0, length: 0x00000018
self_read: process: wscript.exe, pid: 2408, offset: 0x000001e8, length: 0x00000078
self_read: process: wscript.exe, pid: 2408, offset: 0x00018000, length: 0x00000020
self_read: process: wscript.exe, pid: 2408, offset: 0x00018058, length: 0x00000018
self_read: process: wscript.exe, pid: 2408, offset: 0x000181a8, length: 0x00000018
self_read: process: wscript.exe, pid: 2408, offset: 0x00018470, length: 0x00000010
self_read: process: wscript.exe, pid: 2408, offset: 0x00018640, length: 0x00000012
A process created a hidden window
Process: T_C_FOR_.EXE -> C:\Users\user\subfolder\filename.vbs
Process: T_C_FOR_.EXE -> C:\Users\user\subfolder\filename.exe
CAPE extracted potentially suspicious content
T_C_FOR_.EXE: Extracted Shellcode
T_C_FOR_.EXE: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted PE Image: 32-bit executable
filename.exe: AgentTesla Payload: 32-bit executable
filename.exe: [{u'strings': [u'IELibrary.dll', u'GetSavedPasswords', u'C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb', u'GetSavedCookies'], u'meta': {u'cape_type': u'AgentTesla Payload', u'description': u'AgentTesla Payload', u'author': u'kevoreilly'}, u'addresses': {u'agt4': 290689L, u'agt1': 289928L, u'agt2': 293318L, u'agt3': 290593L}, u'name': u'AgentTesla'}]
filename.exe: AgentTesla Payload: 32-bit DLL
filename.exe: [{u'strings': [u'IELibrary.dll', u'GetSavedPasswords', u'C:\\Users\\Admin\\Desktop\\IELibrary\\IELibrary\\obj\\Debug\\IELibrary.pdb', u'GetSavedCookies'], u'meta': {u'cape_type': u'AgentTesla Payload', u'description': u'AgentTesla Payload', u'author': u'kevoreilly'}, u'addresses': {u'agt4': 12119L, u'agt1': 11358L, u'agt2': 14748L, u'agt3': 12023L}, u'name': u'AgentTesla'}]
filename.exe: Extracted Shellcode
filename.exe: Extracted PE Image
filename.exe: Extracted PE Image
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
filename.exe: Extracted Shellcode
A scripting utility was executed
command: "C:\Windows\System32\WScript.exe" "C:\Users\user\subfolder\filename.vbs"
Behavioural detection: Injection (Process Hollowing)
Injection: filename.exe(2728) -> filename.exe(2612)
Executed a process and injected code into it, probably while unpacking
Injection: filename.exe(2728) -> filename.exe(2612)
Attempts to repeatedly call a single API many times in order to delay analysis time
Spam: filename.exe (2728) called API GetLocalTime 61878 times
Spam: services.exe (460) called API GetSystemTimeAsFileTime 158559 times
Spam: T_C_FOR_.EXE (2124) called API GetLocalTime 61878 times
Installs itself for autorun at Windows startup
key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Registry Key Name
data: C:\Users\user\subfolder\filename.vbs -BN
CAPE detected the AgentTesla malware family
Checks the CPU name from registry, possibly for anti-virtualization
Creates a copy of itself
copy: C:\Users\user\subfolder\filename.exe
Drops a binary and executes it
binary: C:\Users\user\subfolder\filename.exe
Collects information to fingerprint the system

Screenshots


Hosts

No hosts contacted.

DNS

No domains contacted.


Summary

C:\Windows\Globalization\Sorting\sortdefault.nls
\Device\KsecDD
C:\Users\user\AppData\Local\Temp\T_C_FOR_.EXE.cfg
C:\Windows\sysnative\C_932.NLS
C:\Windows\sysnative\C_949.NLS
C:\Windows\sysnative\C_950.NLS
C:\Windows\sysnative\C_936.NLS
C:\Users\user\AppData\Local\Temp\yjGJw4yYzVjX246
C:\Users\user
C:\Users
C:\Users\user\subfolder
C:\Windows\SysWOW64\shell32.dll
C:\Users\user\AppData\Local\Temp\T_C_FOR_.EXE
C:\Users\user\subfolder\filename.exe
C:\Users\user\subfolder\filename.vbs
C:\Users\user\AppData\Local\Microsoft\Windows\Caches
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000d.db
C:\Users\user\Desktop\desktop.ini
C:\Windows\SysWOW64\propsys.dll
C:\Windows\sysnative\propsys.dll
C:\
C:\Users\desktop.ini
C:\Users\user\Searches
C:\Users\user\Searches\desktop.ini
\??\MountPointManager
C:\Users\user\Videos
C:\Users\user\Videos\desktop.ini
C:\Users\user\Pictures
C:\Users\user\Pictures\desktop.ini
C:\Users\user\Desktop
C:\Users\user\Contacts
C:\Users\user\Contacts\desktop.ini
C:\Users\user\Favorites
C:\Users\user\Favorites\desktop.ini
C:\Users\user\Music
C:\Users\user\Music\desktop.ini
C:\Users\user\Downloads
C:\Users\user\Downloads\desktop.ini
C:\Users\user\Documents
C:\Users\user\Documents\desktop.ini
C:\Users\user\Links
C:\Users\user\Links\desktop.ini
C:\Users\user\Saved Games
C:\Users\user\Saved Games\desktop.ini
C:\Windows\System32\shdocvw.dll
C:\Windows\AppPatch\sysmain.sdb
C:\Windows\System32\
C:\Windows\SysWOW64\shdocvw.dll
C:\Windows
C:\Windows\System32
C:\Windows\System32\*.*
C:\Windows\System32\en-US\shdocvw.dll.mui
C:\Users\user\subfolder\filename.vbs:Zone.Identifier
C:\Windows\System32\wscript.exe
C:\Windows\SysWOW64\wscript.exe
C:\Windows\SysWOW64\wshom.ocx
C:\Users\user\subfolder\filename.exe.cfg
C:\Windows\System32\mscoree.dll.local
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Windows\Microsoft.NET\Framework\*
C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll
C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll
C:\Users\user\subfolder\filename.exe.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
C:\Users\user\subfolder\filename.exe.Local\
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
C:\Windows\winsxs
C:\Windows\Microsoft.NET\Framework\v4.0.30319
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\fusion.localgac
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\user\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\user\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ole32.dll
C:\Windows\System32\l_intl.nls
C:\Users\user\subfolder\filename.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\GAC\PublisherPolicy.tme
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.INI
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.INI
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.INI
C:\Windows\Globalization\en-gb.nlp
C:\Windows\Globalization\en-us.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bcrypt.dll
C:\Windows\System32\tzres.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI
C:\Windows\System32\wbem\wbemdisp.tlb
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\Microsoft.NET\Framework\v2.0.50727\OLEAUT32.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\CustomMarshalers.ni.dll
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.INI
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\oleaut32.DLL
C:\Windows\SysWOW64\stdole2.tlb
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\System.Management.ni.dll
C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.INI
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\oleaut32.dll
C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\ntdll.dll
C:\%insfolder%\%insname%
C:\Users\user\AppData\Local\Google\Chrome\User Data\
C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Windows\assembly\GAC_32\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\0.0.0.0_en-US_461d39c4a423da0b
C:\Windows\assembly\GAC_MSIL\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\0.0.0.0_en-US_461d39c4a423da0b
C:\Windows\assembly\GAC\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\0.0.0.0_en-US_461d39c4a423da0b
C:\Users\user\subfolder\en-US\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources.dll
C:\Users\user\subfolder\en-US\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources.dll
C:\Users\user\subfolder\en-US\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources.exe
C:\Users\user\subfolder\en-US\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en-US\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\en\mscorrc.dll.DLL
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Windows\Globalization\en.nlp
C:\Windows\assembly\GAC_32\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\0.0.0.0_en_461d39c4a423da0b
C:\Windows\assembly\GAC_MSIL\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\0.0.0.0_en_461d39c4a423da0b
C:\Windows\assembly\GAC\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\0.0.0.0_en_461d39c4a423da0b
C:\Users\user\subfolder\en\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources.dll
C:\Users\user\subfolder\en\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources.dll
C:\Users\user\subfolder\en\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources.exe
C:\Users\user\subfolder\en\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources\DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources.exe
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies
C:\Users\user\AppData\Local\Microsoft\Windows\History
C:\Users\user\AppData\Local\Microsoft\Windows\History\desktop.ini
C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5
C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\
C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
C:\Users\user\subfolder\vaultcli.dll
\??\PIPE\samr
C:\DosDevices\pipe\
C:\Windows\sysnative\wbem\repository
C:\Windows\sysnative\wbem\Logs
C:\Windows\sysnative\wbem\AutoRecover
C:\Windows\sysnative\wbem\MOF
C:\Windows\sysnative\wbem\repository\INDEX.BTR
C:\Windows\sysnative\wbem\repository\WRITABLE.TST
C:\Windows\sysnative\wbem\repository\MAPPING1.MAP
C:\Windows\sysnative\wbem\repository\MAPPING2.MAP
C:\Windows\sysnative\wbem\repository\MAPPING3.MAP
C:\Windows\sysnative\wbem\repository\OBJECTS.DATA
C:\Windows\sysnative\wbem\repository\WBEM9xUpgd.dat
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
C:\Windows\sysnative\wbem\Logs\
\??\WMIDataDevice
C:\Windows\Temp
C:\Windows\Globalization\Sorting\sortdefault.nls
\Device\KsecDD
C:\Windows\SysWOW64\shell32.dll
C:\Users\user\AppData\Local\Temp\T_C_FOR_.EXE
C:\Users\user\subfolder\filename.vbs
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db
C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000d.db
C:\Users\user\Desktop\desktop.ini
C:\
C:\Users\desktop.ini
C:\Users
C:\Users\user
C:\Users\user\Searches\desktop.ini
C:\Users\user\Videos\desktop.ini
C:\Users\user\Pictures\desktop.ini
C:\Users\user\Contacts\desktop.ini
C:\Users\user\Favorites\desktop.ini
C:\Users\user\Music\desktop.ini
C:\Users\user\Downloads\desktop.ini
C:\Users\user\Documents\desktop.ini
C:\Users\user\Links\desktop.ini
C:\Users\user\Saved Games\desktop.ini
C:\Windows\System32\shdocvw.dll
C:\Windows\AppPatch\sysmain.sdb
C:\Windows\System32\
C:\Windows\System32\en-US\shdocvw.dll.mui
C:\Windows\System32\wscript.exe
C:\Windows\SysWOW64\wscript.exe
C:\Windows\SysWOW64\wshom.ocx
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll
C:\Users\user\subfolder\filename.exe.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
C:\Windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\machine.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch
C:\Users\user\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config
C:\Users\user\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch
C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
C:\Windows\System32\l_intl.nls
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll
C:\Windows\assembly\pubpol23.dat
C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9e0a3b9b9f457233a335d7fba8f95419\System.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\dbfe8642a8ed7b2b103ad28e0c96418a\System.Drawing.ni.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\3afcd5168c7a6cb02eab99d7fd71e102\System.Windows.Forms.ni.dll
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
C:\Windows\System32\tzres.dll
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\08d608378aa405adc844f3cf36974b8c\Microsoft.VisualBasic.ni.dll
C:\Windows\System32\wbem\wbemdisp.tlb
C:\Windows\SysWOW64\en-US\KERNELBASE.dll.mui
C:\Windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\bf7e7494e75e32979c7824a07570a8a9\CustomMarshalers.ni.dll
C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
C:\Windows\SysWOW64\stdole2.tlb
C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\System.Management.ni.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\wminet_utils.dll
C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
\??\PIPE\samr
C:\Windows\sysnative\wbem\repository\MAPPING1.MAP
C:\Windows\sysnative\wbem\repository\MAPPING2.MAP
C:\Windows\sysnative\wbem\repository\MAPPING3.MAP
C:\Windows\sysnative\wbem\repository\OBJECTS.DATA
C:\Windows\sysnative\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\WMIDataDevice
C:\Users\user\subfolder\filename.exe
C:\Users\user\subfolder\filename.vbs
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
C:\Users\user\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
\??\PIPE\samr
C:\Windows\sysnative\wbem\repository\WRITABLE.TST
C:\Windows\sysnative\wbem\repository\MAPPING1.MAP
C:\Windows\sysnative\wbem\repository\MAPPING2.MAP
C:\Windows\sysnative\wbem\repository\MAPPING3.MAP
C:\Windows\sysnative\wbem\repository\OBJECTS.DATA
C:\Windows\sysnative\wbem\repository\INDEX.BTR
\??\pipe\PIPE_EVENTROOT\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER
\??\pipe\PIPE_EVENTROOT\CIMV2PROVIDERSUBSYSTEM
\??\WMIDataDevice
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLEAUT
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\CustomLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-GB
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\ExtendedLocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-GB
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Language Groups
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale\00000809
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups\1
DisableUserModeCallbackFilter
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\WMR
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\Windows Error Reporting\WMR\Disable
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en-US
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\SafeProcessSearchMode
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Nls\Codepage
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\932
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\949
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\950
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage\936
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA\Monitors
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\T_C_FOR_.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\T_C_FOR_.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesRecycleBin
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoInternetIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\T_C_FOR_.EXE
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoCommonGroups
HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder\HasNavigationEnum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\NonEnum
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}\DriveMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\AllowFileCLSIDJunctions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DontShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ClassicShell
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SeparateProcess
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoNetCrawling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSimpleStartMenu
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\NoNetCrawling
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay
HKEY_CLASSES_ROOT\.vbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs\(Default)
HKEY_CLASSES_ROOT\.vbs\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\UserChoice
HKEY_CLASSES_ROOT\VBSFile
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\ShellEx\IconHandler
HKEY_CLASSES_ROOT\SystemFileAssociations\.vbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs\PerceivedType
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs\Content Type
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\NeverShowExt
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FolderDescriptions
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\KnownFolders
HKEY_CURRENT_USER
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Desktop
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\AccessProviders
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\AccessProviders\MartaExtension
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KnownFolderSettings
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Shell\RegisteredApplications\UrlAssociations\Directory\OpenWithProgids
HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\Directory
HKEY_CLASSES_ROOT\Directory
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\CurVer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\ShellEx\IconHandler
HKEY_CLASSES_ROOT\Folder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\ShellEx\IconHandler
HKEY_CLASSES_ROOT\AllFilesystemObjects
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\ShellEx\IconHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\DocObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\BrowseInPlace
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\Clsid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\IsShortcut
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\AlwaysShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AllFilesystemObjects\NeverShowExt
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\AppData
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\PropertyBag
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-120665959-548228820-2376508522-1001\ProfileImagePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F}\PropertyBag
HKEY_CLASSES_ROOT\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder\HasNavigationEnum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{59031A47-3F72-44A7-89C5-5595FE6B30EE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7D1D3A04-DEBB-4115-95CF-2F29DA2920DA}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2112AB0A-C86A-4FFE-A368-0DE96E47012E}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{48DAF80B-E6CF-4F4E-B800-0E69D84EE384}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4AA340D-F20F-4863-AFEF-F87EF2E6BA25}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E52AB10-F80D-49DF-ACB8-4330F5687855}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{98EC0E18-2098-4D44-8644-66979315A281}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{CAC52C1A-B53D-4EDC-92D7-6B2E8AC19434}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{76FC4E2D-D6AD-4519-A663-37BD56068185}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A75D362E-50FC-4FB7-AC2C-A8BEAA314493}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{491E922F-5643-4AF4-A7EB-4E7A138D8174}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{33E28130-4E1E-4676-835A-98395C3BC3BB}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8AD10C31-2ADB-4296-A8F7-E4701232C972}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DEBF2536-E1A8-4C59-B6A2-414586476AEA}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0F214138-B1D3-4A90-BBA9-27CBC0C5389A}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2400183A-6185-49FB-A2D8-4A392A602BA3}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D9DC8A3B-B784-432E-A781-5A1130A75963}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C4900540-2379-4C75-844B-64E6FAF8716B}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{289A9A43-BE44-4057-A41B-587A76D7E7F9}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BFEFB45-347D-4006-A5BE-AC0CB0567192}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C870044B-F49E-4126-A9C3-B52A1FF411E8}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C5ABBF53-E17F-4121-8900-86626FC2C973}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{56784854-C6CB-462B-8169-88E350ACB882}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B396E54-9EC5-4300-BE0A-2482EBAE1A26}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCBD3057-CA5C-4622-B42D-BC56DB0AE516}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A302545D-DEFF-464B-ABE8-61C8648D939B}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2A00375E-224C-49DE-B8D1-440DF7EF3DDC}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{E555AB60-153B-4D17-9F04-A5FE99FC15EC}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{054FAE61-4DD8-4787-80B6-090220C4B700}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B250C668-F57D-4EE1-A63C-290EE7D1AA1F}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{52528A6B-B9E3-4ADD-B60D-588C2DBA842D}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{8983036C-27C0-404B-8F08-102D10DCFD74}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BCB5256F-79F6-4CEE-B725-DC34E402FD46}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{724EF170-A42D-4FEF-9F26-B60E846FBA4F}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4BD8D571-6D19-48D3-BE97-422220080E43}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE61D971-5EBC-4F02-A3A9-6C82895E5C04}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0762D272-C50A-4BB0-A382-697DCD729B80}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4D9F7874-4E0C-4904-967B-40B0D20C3E4B}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{0AC0837C-BBF8-452A-850D-79D08E667CA7}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D0384E7D-BAC3-4797-8F14-CBA229B392B5}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7B0DB17D-9CD2-4A93-9733-46CC89022E7C}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{AE50C081-EBD2-438A-8655-8A092E34987A}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{F1B32785-6FBA-4FCF-9D55-7B8E7F157091}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9274BD8D-CFD1-41C3-B35E-B13F55A758F4}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{374DE290-123F-4565-9164-39C4925E467B}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{859EAD94-2E85-48AD-A71A-0969CB56A6CD}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A305CE99-F527-492B-8B1A-7E76FA98D6E4}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A990AE9F-A03B-4E80-94BC-9912D7504104}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DFDF76A2-C82A-4D63-906A-5644AC457385}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{1A6FDBA2-F42D-4358-A798-B74D745926C5}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A520A1A4-1780-4FF6-BD18-167343C5AF16}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B88F4DAA-E7BD-49A9-B74D-02885A5DC765}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{2C36C0AA-5812-4B87-BFD0-4CD0DFB19B39}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{9E3995AB-1F9C-4F13-B827-48B24B6C7174}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DF7266AC-9274-4867-8D55-3BD661DE872D}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{905E63B6-C1BF-494E-B29C-65B732D3D21A}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B97D20BB-F46A-4C97-BA10-5E3608430854}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{D20BEEC4-5CA8-4905-AE3B-BF251EA09B53}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{10C07CD0-EF91-4567-B850-448B77CB37F9}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{190337D1-B8CA-4121-A639-6D472D16972A}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{54EED2E0-E7CA-4FDB-9148-0F4247291CFA}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CD7AEE2-2219-4A67-B85D-6C9CE15660CB}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{B94237E7-57AC-4347-9151-B08C6C32D1F7}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{352481E8-33BE-4251-BA85-6007CAEDCF9D}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{A63293E8-664E-48DB-A079-DF759E0509F7}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{5CE4A5E9-E4EB-479D-B89F-130C02886155}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{82A74AEB-AEB4-465C-A014-D097EE346D63}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{43668BF8-C14E-49B2-97C9-747784D784B7}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{915221FB-9EFE-4BDA-8FD7-F78DCA774F87}\PropertyBag
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\Category
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\Name
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\ParentFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\Description
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\RelativePath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\ParsingName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\InfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\LocalizedName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\Icon
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\StreamResource
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\StreamResourceType
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\LocalRedirectOnly
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\Roamable
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\PreCreate
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\Stream
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\PublishExpandedPath
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\FolderTypeID
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\InitFolderHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\FolderDescriptions\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\PropertyBag
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cd-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Explorer
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{3abfb8f2-2ffd-11e7-a4cf-806e6f6e6963}\Generation
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Data
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{5e1375cc-b5ba-11e3-a2f5-806e6f6e6963}\Generation
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\UsersFiles\NameSpace\DelegateFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\UsersFiles\NameSpace\DelegateFolders\SuppressionPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\UsersFiles\NameSpace\DelegateFolders\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\UsersFiles\NameSpace\DelegateFolders\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\UsersFiles\NameSpace\DelegateFolders\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SuppressionPolicy
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UsersFiles\NameSpace\DelegateFolders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\UsersFiles\NameSpace
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\UsersFiles\NameSpace\DelegateFolders
HKEY_CLASSES_ROOT\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\Attributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\CallForAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\RestrictedAttributes
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\WantsFORDISPLAY
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\HideFolderVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\UseDropHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\WantsFORPARSING
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\WantsParseDisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\QueryForOverlay
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\MapNetDriveVerbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\QueryForInfoTip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\HideInWebView
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\HideOnDesktopPerUser
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\WantsAliasedNotifications
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\WantsUniversalDelegate
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\NoFileFolderJunction
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\PinToNameSpaceTree
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder\HasNavigationEnum
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\ShellFolder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\NonEnum\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}
HKEY_CLASSES_ROOT\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InProcServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InProcServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\InProcServer32\LoadWithoutCOM
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCompatibility
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppCompat
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{dffacdc5-679f-4156-8947-c5c76bc0b67f}\InProcServer32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{DFFACDC5-679F-4156-8947-C5C76BC0B67F} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\KindMap
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\KindMap\.vbs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\NoStaticDefaultVerb
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\shell
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\NeverDefault
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\DelegateExecute
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\DropTarget
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
HKEY_CLASSES_ROOT\.ade
HKEY_CLASSES_ROOT\.adp
HKEY_CLASSES_ROOT\.app
HKEY_CLASSES_ROOT\.asp
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp\(Default)
HKEY_CLASSES_ROOT\.bas
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bas\(Default)
HKEY_CLASSES_ROOT\.bat
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat\(Default)
HKEY_CLASSES_ROOT\.cer
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer\(Default)
HKEY_CLASSES_ROOT\.chm
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm\(Default)
HKEY_CLASSES_ROOT\.cmd
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd\(Default)
HKEY_CLASSES_ROOT\.com
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com\(Default)
HKEY_CLASSES_ROOT\.cpl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl\(Default)
HKEY_CLASSES_ROOT\.crt
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt\(Default)
HKEY_CLASSES_ROOT\.csh
HKEY_CLASSES_ROOT\.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe\(Default)
HKEY_CLASSES_ROOT\.fxp
HKEY_CLASSES_ROOT\.gadget
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.gadget\(Default)
HKEY_CLASSES_ROOT\.grp
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.grp\(Default)
HKEY_CLASSES_ROOT\.hlp
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hlp\(Default)
HKEY_CLASSES_ROOT\.hta
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hta\(Default)
HKEY_CLASSES_ROOT\.inf
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf\(Default)
HKEY_CLASSES_ROOT\.ins
HKEY_CLASSES_ROOT\.isp
HKEY_CLASSES_ROOT\.its
HKEY_CLASSES_ROOT\.js
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js\(Default)
HKEY_CLASSES_ROOT\.jse
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.JSE\(Default)
HKEY_CLASSES_ROOT\.ksh
HKEY_CLASSES_ROOT\.lnk
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\(Default)
HKEY_CLASSES_ROOT\.mad
HKEY_CLASSES_ROOT\.maf
HKEY_CLASSES_ROOT\.mag
HKEY_CLASSES_ROOT\.mam
HKEY_CLASSES_ROOT\.maq
HKEY_CLASSES_ROOT\.mar
HKEY_CLASSES_ROOT\.mas
HKEY_CLASSES_ROOT\.mat
HKEY_CLASSES_ROOT\.mau
HKEY_CLASSES_ROOT\.mav
HKEY_CLASSES_ROOT\.maw
HKEY_CLASSES_ROOT\.mcf
HKEY_CLASSES_ROOT\.mda
HKEY_CLASSES_ROOT\.mdb
HKEY_CLASSES_ROOT\.mde
HKEY_CLASSES_ROOT\.mdt
HKEY_CLASSES_ROOT\.mdw
HKEY_CLASSES_ROOT\.mdz
HKEY_CLASSES_ROOT\.msc
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msc\(Default)
HKEY_CLASSES_ROOT\.msh
HKEY_CLASSES_ROOT\.mshxml
HKEY_CLASSES_ROOT\.msi
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msi\(Default)
HKEY_CLASSES_ROOT\.msp
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msp\(Default)
HKEY_CLASSES_ROOT\.mst
HKEY_CLASSES_ROOT\.ops
HKEY_CLASSES_ROOT\.pcd
HKEY_CLASSES_ROOT\.pif
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pif\(Default)
HKEY_CLASSES_ROOT\.pl
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pl\(Default)
HKEY_CLASSES_ROOT\.prf
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.prf\(Default)
HKEY_CLASSES_ROOT\.prg
HKEY_CLASSES_ROOT\.pst
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pst\(Default)
HKEY_CLASSES_ROOT\.reg
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.reg\(Default)
HKEY_CLASSES_ROOT\.scf
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scf\(Default)
HKEY_CLASSES_ROOT\.scr
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scr\(Default)
HKEY_CLASSES_ROOT\.sct
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sct\(Default)
HKEY_CLASSES_ROOT\.shb
HKEY_CLASSES_ROOT\.shs
HKEY_CLASSES_ROOT\.tmp
HKEY_CLASSES_ROOT\.url
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.URL\(Default)
HKEY_CLASSES_ROOT\.vb
HKEY_CLASSES_ROOT\.vbe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.VBE\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\CreateUriCacheSize
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\EnablePunycode
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\T_C_FOR_.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\*
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Security
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck
HKEY_LOCAL_MACHINE\System\Setup
HKEY_LOCAL_MACHINE\SYSTEM\Setup\SystemSetupInProgress
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\T_C_FOR_.EXE
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\T_C_FOR_.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\*
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\SpecialFoldersCacheSize
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\T_C_FOR_.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN\*
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1806
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\command
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\App Paths\WScript.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\WScript.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Progid
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellCompatibility\ProgIDs\VBSFile
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\InheritConsoleHandles
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\ddeexec
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\SetWorkingDirectoryFromTarget
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\NoWorkingDirectory
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\Enabled
HKEY_CURRENT_USER\Software\Classes
HKEY_CURRENT_USER\Software\Classes\AppID\WScript.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\LogSecuritySuccesses
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\IgnoreUserSettings
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\TrustPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\UseWINSAFER
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\Timeout
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings\DisplayLogo
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\Timeout
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings\DisplayLogo
HKEY_CLASSES_ROOT\VBSFile\ScriptEngine
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBSFile\ScriptEngine\(Default)
HKEY_CURRENT_USER\Software\Classes\VBScript
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBScript\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VBScript\CLSID\(Default)
HKEY_CURRENT_USER\Software\Classes\TypeLib
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\409
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\9
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{F935DC20-1CF0-11D0-ADB9-00C04FD58A0B}\1.0\0\win32\(Default)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Registry Key Name
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\v4.0
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\InstallRoot
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\CLRLoadLogDir
HKEY_CURRENT_USER\Software\Microsoft\.NETFramework
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\OnlyUseLatestCLR
Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\Standards\v2.0.50727
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStart
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\GCStressStartAtJit
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DisableConfigCache
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Policy\AppPatch
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Policy\AppPatch\v4.0.30319.00000\mscorwks.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\filename.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\CacheLocation
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB
HKEY_CURRENT_USER\Software\Microsoft\Fusion
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\EnableLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LoggingLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\ForceLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogFailures
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\VersioningLog
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\LogResourceBinds
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\DisableMSIPeek
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NoClientChecks
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\Security\Policy
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\LatestIndex
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\NIUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index149\ILUsageMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\181938c6\7950e2c5\83\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\7950e2c5\183e33de\83\LastModTime
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\GACChangeNotification\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,2.0.0.0,,b77a5c561934e089,x86
HKEY_LOCAL_MACHINE\Software\Microsoft\StrongName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3fce6556\33601ea8
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\mscorjit.dll
HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\PublisherPolicy\Default
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index23
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Drawing__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\3cca06a0\6dc7d4c0\7b\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\6dc7d4c0\a5cd4db\7e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\30bc7c4f\3f50fe4f\88\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\424bd4d8\1c83327b\86\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\19ab8d57\1bd7b0d8\87\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3f50fe4f\6f1da7aa\88\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Xml__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Windows.Forms__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\61e7e666\c991064\7a\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\475dce40\2d382ce6\85\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2dd6ac50\163e1f5e\80\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\41c04c7e\7f3b6ac4\78\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3ced59c5\1b2590b1\7c\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\c991064\2bd33e1c\79\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Deployment__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Serialization.Formatters.Soap__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Serialization.Formatters.Soap,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.Accessibility__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Accessibility,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Security__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy\Enabled
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\FipsAlgorithmPolicy
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\ProductId
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgJITDebugLaunchSetting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\DbgManagedDebugger
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualBasic__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\1c22df2f\4f99a7c9\2e\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\f6e8397\46ad0879\6f\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\2b1a4e4\38a3212c\44\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\24bf93f6\455bab30\6e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\4f99a7c9\53bea2b0\2e\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Web__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Web,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Management__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Runtime.Remoting__b77a5c561934e089
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,2.0.0.0,,b77a5c561934e089,MSIL
HKEY_CURRENT_USER\Software\Classes\AppID\filename.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE\AppCompat
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\AppCompat\RaiseDefaultAuthnLevel
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE\DefaultAccessPermission
HKEY_CURRENT_USER\Software\Classes\Interface\{00000134-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00000134-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Extensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\NdrOleExtDLL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Extensions\RemoteRpcDll
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledProcesses\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledProcesses\3044CEB1
HKEY_LOCAL_MACHINE\Software\Microsoft\SQMClient\Windows\DisabledSessions\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\MachineThrottling
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SQMClient\Windows\DisabledSessions\GlobalSession
HKEY_CURRENT_USER\Software\Classes\WinMgmts
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WINMGMTS\CLSID\(Default)
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\Scripting\Default Namespace
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Hostname
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\System\DNSclient
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters\Domain
HKEY_CURRENT_USER\Software\Classes\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\ProxyStubClsid32\(Default)
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\ExtendedLocale\en
HKEY_CURRENT_USER\Software\Classes\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9556DC99-828C-11CF-A37E-00AA003240C7}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\InprocHandler
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\0\win32\(Default)
HKEY_CLASSES_ROOT\CLSID\{62E522DC-8CF3-40A8-8B2E-37D595651E40}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\809
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{565783C6-CB41-11D1-8B02-00600806D9B6}\1.2\9
HKEY_CURRENT_USER\Software\Classes\Interface\{027947E1-D731-11CE-A357-000000000001}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{027947E1-D731-11CE-A357-000000000001}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TreatAs
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\Progid
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocServer32\ThreadingModel
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\InprocHandler
HKEY_CURRENT_USER\Software\Classes\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CURRENT_USER\Software\Classes\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{423EC01E-2E35-11D2-B604-00104B703EFD}\ProxyStubClsid32\(Default)
HKEY_CLASSES_ROOT\CLSID\{04B83D61-21AE-11D2-8B33-00600806D9B6}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.CustomMarshalers__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\109d7e79\357ee49a\44\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\3d590c3f\59f3b67b\82\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\7d2df0ec\41
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\7d2df0ec\41\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\7d2df0ec\41\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\7d2df0ec\41\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\7d2df0ec\41\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\357ee49a\7d2df0ec\41\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\CustomMarshalers,2.0.0.0,,b03f5f7f11d50a3a,x86
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.VisualC__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualC,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\CustomMarshalers.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\CustomMarshalers.ni.dll
HKEY_CLASSES_ROOT\CLSID\{D6BDAFB2-9435-491F-BB87-6AA0F0BC31A2}\InprocServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32\(Default)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\ConfigMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\ConfigString
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\MVID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\EvalationData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\ILDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\NIDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\5a8de2c3\2b1a4e4\47\MissingDependencies
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\73843e06\43a920ef\66\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\6b79efab\43
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\6b79efab\43\DisplayName
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\6b79efab\43\Status
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\6b79efab\43\Modules
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\6b79efab\43\SIG
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\141dfd70\6b79efab\43\LastModTime
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.8.0.Microsoft.JScript__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.JScript,8.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.2.0.System.Configuration.Install__b03f5f7f11d50a3a
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration.Install,2.0.0.0,,b03f5f7f11d50a3a,MSIL
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\wminet_utils.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\System.Management.ni.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3\FinalizerActivityBypass
HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\WBEM\CIMOM\EnableObjectValidation
HKEY_CURRENT_USER\Control Panel\International
HKEY_CURRENT_USER\Control Panel\International\sYearMonth
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.0.0.DAPNRKMBZDUBJJEGYMNEKEVUPSWDEFYGGYZRBUOJ_20190910160327355.resources_en-US_461d39c4a423da0b
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\58fc596e\7bdd5488
HK