"\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Ck" in Source: 00000000-00001196.00000000.72077.00340000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001196.00000000.72077.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Ck" in Source: 00000000-00001196.00000001.72247.003A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001196.00000001.72247.7EFE0000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LogonStats" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\{11517B7C-E79D-4e20-961B-75A811715ADD}" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users" in Source: 00000000-00001340.00000000.88499.3FBC7000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001340.00000000.88499.7EFE0000.00000002.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/xml" in Source: 00000000-00001340.00000001.90417.00180000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001340.00000001.90417.00180000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00001340.00000001.90417.00180000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LogonStats" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\{11517B7C-E79D-4e20-961B-75A811715ADD}" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users" in Source: 00000000-00001340.00000001.90417.3FBC7000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001340.00000001.90417.7EFE0000.00000002.mdmp "SOFTWARE\Microsoft\Office\14.0\Common\Filter\text/xml" in Source: 00000000-00001340.00000001.90417.F6399000.00000002.mdmp "SOFTWARE\Microsoft\Shared\XML\AlternateProgIDs" in Source: 00000000-00001340.00000001.90417.F6399000.00000002.mdmp "SOFTWARE\Microsoft\Shared\XML\ProgIDs" in Source: 00000000-00001340.00000001.90417.F6399000.00000002.mdmp "Software\Microsoft\Security" in Source: 00000000-00001340.00000001.90417.F6399000.00000002.mdmp "Software\Policies\Microsoft\Security" in Source: 00000000-00001340.00000001.90417.F6399000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00001596.00000000.74879.00280000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001596.00000000.74879.00280000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001596.00000000.74879.7EFE0000.00000002.mdmp "Software\Microsoft\WBEM\CIMOM" in Source: 00000000-00001596.00000000.74879.FFA51000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance" in Source: 00000000-00001596.00000000.74879.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance" in Source: 00000000-00001596.00000000.74879.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00001596.00000000.74879.FFA51000.00000020.mdmp "Software\Microsoft\WBEM\WDM" in Source: 00000000-00001596.00000000.74879.FFA51000.00000020.mdmp "Software\Microsoft\WBEM\WDM\DREDGE" in Source: 00000000-00001596.00000000.74879.FFA51000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00001596.00000001.76802.00280000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001596.00000001.76802.00280000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001596.00000001.76802.7EFE0000.00000002.mdmp "Software\Microsoft\WBEM\CIMOM" in Source: 00000000-00001596.00000001.76802.FFA51000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance" in Source: 00000000-00001596.00000001.76802.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance" in Source: 00000000-00001596.00000001.76802.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00001596.00000001.76802.FFA51000.00000020.mdmp "Software\Microsoft\WBEM\WDM" in Source: 00000000-00001596.00000001.76802.FFA51000.00000020.mdmp "Software\Microsoft\WBEM\WDM\DREDGE" in Source: 00000000-00001596.00000001.76802.FFA51000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00001596.00000002.78720.00280000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001596.00000002.78720.00280000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001596.00000002.78720.7EFE0000.00000002.mdmp "Software\Microsoft\WBEM\CIMOM" in Source: 00000000-00001596.00000002.78720.FFA51000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance" in Source: 00000000-00001596.00000002.78720.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance" in Source: 00000000-00001596.00000002.78720.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00001596.00000002.78720.FFA51000.00000020.mdmp "Software\Microsoft\WBEM\WDM" in Source: 00000000-00001596.00000002.78720.FFA51000.00000020.mdmp "Software\Microsoft\WBEM\WDM\DREDGE" in Source: 00000000-00001596.00000002.78720.FFA51000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\W" in Source: 00000000-00001596.00000003.78792.002DB000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}" in Source: 00000000-00001596.00000003.78792.002E9000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00001596.00000003.78792.7EFE0000.00000002.mdmp "Software\Microsoft\WBEM\CIMOM" in Source: 00000000-00001596.00000003.78792.FFA51000.00000020.mdmp "SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance" in Source: 00000000-00001596.00000003.78792.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance" in Source: 00000000-00001596.00000003.78792.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\Wbem\CIMOM" in Source: 00000000-00001596.00000003.78792.FFA51000.00000020.mdmp "Software\Microsoft\WBEM\WDM" in Source: 00000000-00001596.00000003.78792.FFA51000.00000020.mdmp "Software\Microsoft\WBEM\WDM\DREDGE" in Source: 00000000-00001596.00000003.78792.FFA51000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LogonStats" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\{11517B7C-E79D-4e20-961B-75A811715ADD}" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users" in Source: 00000000-00002308.00000000.86634.3FBC7000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002308.00000000.86634.7EFE0000.00000002.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoItv3" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Appraiser\GWX" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180151F0}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32A3A4F4-B792-11D6-A78A-00B0D0180151}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{739A853C-D71F-404B-9E6A-012D3918ED57}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8972AC25-452E-4FFE-945A-EB9E28C20322}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{a98dc6ff-d360-4878-9f0a-915eba86eaf3}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AEAA18F7-9C96-4A43-BC07-8B88A4913EEB}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}" in Source: 00000000-00002308.00000001.88555.00090000.00000004.mdmp " " in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{772A6680-74F3-478F-AD22-3909187540FD} \" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUSR" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "oftware\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 57.0.1 (x64 en-US)" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{16735AF7-1D8D-3681-94A5-C578A61EC832}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F64180151F0}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-040C-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0043-0000-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0043-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0115-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0117-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{91140000-0011-0000-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Shockwave Player" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUSR" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoItv3" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_USERS\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180151F0}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32A3A4F4-B792-11D6-A78A-00B0D0180151}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{739A853C-D71F-404B-9E6A-012D3918ED57}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8972AC25-452E-4FFE-945A-EB9E28C20322}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{a98dc6ff-d360-4878-9f0a-915eba86eaf3}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AEAA18F7-9C96-4A43-BC07-8B88A4913EEB}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp " Empty Migration Data-{772A6680-74F3-478F-AD22-3909187540FD} HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{772A6680-74F3-478F-AD22-3909187540FD} [EMPTY] " in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp " HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\PendingNotifications [Homegroup]" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp " HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\PendingNotifications [Homegroup]" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 57.0.1 (x64 en-US)" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{16735AF7-1D8D-3681-94A5-C578A61EC832}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F64180151F0}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" in Source: 00000000-00002308.00000001.88555.02AE0000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002308.00000001.88555.0382F000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002308.00000001.88555.03C8D000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LogonStats" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\{11517B7C-E79D-4e20-961B-75A811715ADD}" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users" in Source: 00000000-00002308.00000001.88555.3FBC7000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002308.00000001.88555.7EFE0000.00000002.mdmp "KEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoItv3" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Appraiser\GWX" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180151F0}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32A3A4F4-B792-11D6-A78A-00B0D0180151}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{739A853C-D71F-404B-9E6A-012D3918ED57}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8972AC25-452E-4FFE-945A-EB9E28C20322}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{a98dc6ff-d360-4878-9f0a-915eba86eaf3}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AEAA18F7-9C96-4A43-BC07-8B88A4913EEB}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}" in Source: 00000000-00002308.00000002.90472.00090000.00000004.mdmp " " in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{772A6680-74F3-478F-AD22-3909187540FD} \" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUSR" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "oftware\Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 57.0.1 (x64 en-US)" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{16735AF7-1D8D-3681-94A5-C578A61EC832}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F64180151F0}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.00D70000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}_Office14.PROPLUSR_{EC583796-6BBB-47DD-B9CE-B5DA12D71135}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-040C-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0C0A-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-002C-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0043-0000-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0043-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0044-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-006E-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00A1-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-00BA-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0115-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0117-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{91140000-0011-0000-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{EF1EC6A9-17DE-3DA9-B040-686A1E8A8B04}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Shockwave Player" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Office14.PROPLUSR" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\MozillaMaintenanceService" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoItv3" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WinPcapInst" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_USERS\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F32180151F0}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{32A3A4F4-B792-11D6-A78A-00B0D0180151}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{612C34C7-5E90-47D8-9B5C-0F717DD82726}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{739A853C-D71F-404B-9E6A-012D3918ED57}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{8972AC25-452E-4FFE-945A-EB9E28C20322}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{a98dc6ff-d360-4878-9f0a-915eba86eaf3}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AEAA18F7-9C96-4A43-BC07-8B88A4913EEB}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{d992c12e-cab2-426f-bde3-fb8c53950b0d}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp " Empty Migration Data-{772A6680-74F3-478F-AD22-3909187540FD} HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\{772A6680-74F3-478F-AD22-3909187540FD} [EMPTY] " in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp " HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\PendingNotifications [Homegroup]" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp " HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\PendingNotifications [Homegroup]" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 57.0.1 (x64 en-US)" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{16735AF7-1D8D-3681-94A5-C578A61EC832}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F64180151F0}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{50A2BC33-C9CD-3BF1-A8FF-53C10A0B183C}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0015-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0016-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0018-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-0019-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001A-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001B-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{90140000-001F-0409-1000-0000000FF1CE}" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" in Source: 00000000-00002308.00000002.90472.02AE0000.00000004.mdmp "TRACE,AppvAppFinder::EnumeratePackages,446,RegOpenKeyEx failed to open appv root key_ Software\Microsoft\AppV\Client\Packages_ (2)" in Source: 00000000-00002308.00000002.90472.03C88000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8FB4AD7-EA4A-4B47-BFDC-BFC94160A8EA}" in Source: 00000000-00002308.00000002.90472.04490000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\LogonStats" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\{11517B7C-E79D-4e20-961B-75A811715ADD}" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "Software\Policies\Microsoft\Windows\DataCollection" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users" in Source: 00000000-00002308.00000002.90472.3FBC7000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002308.00000002.90472.7EFE0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\Sorting\Versions" in Source: 00000000-00002344.00000000.86303.000DD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002344.00000000.86303.7EFE0000.00000002.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Nls\Sorting\Versions" in Source: 00000000-00002344.00000000.86308.000DD000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002344.00000000.86308.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00002372.00000000.82982.002B0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00002372.00000000.82982.002B0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002372.00000000.82982.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00002372.00000001.83123.00313000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00002372.00000001.83123.00313000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002372.00000001.83123.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00002736.00000000.69850.00320000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00002736.00000000.69850.00320000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002736.00000000.69850.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00002736.00000001.70036.00383000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00002736.00000001.70036.00383000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002736.00000001.70036.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00003044.00000000.85174.00440000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00003044.00000000.85174.00440000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003044.00000000.85174.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C" in Source: 00000000-00003044.00000001.85337.004A3000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00003044.00000001.85337.004A3000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003044.00000001.85337.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wh" in Source: 00000000-00003548.00000000.74286.003E0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00003548.00000000.74286.003E0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003548.00000000.74286.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00003548.00000001.74447.00443000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003548.00000001.74447.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C`" in Source: 00000000-00003664.00000000.80844.002F0000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00003664.00000000.80844.002F0000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003664.00000000.80844.7EFE0000.00000002.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\C`" in Source: 00000000-00003664.00000001.80939.00353000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}" in Source: 00000000-00003664.00000001.80939.00353000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003664.00000001.80939.7EFE0000.00000002.mdmp