What is invsetup.exe?
invsetup.exe is part of Inventoria and developed by NCH Software according to the invsetup.exe version information.
invsetup.exe's description is "Inventoria Stock Manager"
invsetup.exe is digitally signed by NCH Software Pty Ltd.
invsetup.exe is usually located in the 'c:\downloads\' folder.
None of the anti-virus scanners at VirusTotal reports anything malicious about invsetup.exe.
If you have additional information about the file, please share it with the FreeFixer users by posting a comment at the bottom of this page.
Vendor and version information [?]
The following is the available information on invsetup.exe:
| Property | Value |
|---|---|
| Product name | Inventoria |
| Company name | NCH Software |
| File description | Inventoria Stock Manager |
| Internal name | Inventoria |
| Original filename | Inventoria.exe |
| Legal copyright | NCH Software |
| Product version | 4.03 |
| File version | 4.03 |
Here's a screenshot of the file properties when displayed by Windows Explorer:
| Product name | Inventoria |
| Company name | NCH Software |
| File description | Inventoria Stock Manager |
| Internal name | Inventoria |
| Original filename | Inventoria.exe |
| Legal copyright | NCH Software |
| Product version | 4.03 |
| File version | 4.03 |
Digital signatures [?]
invsetup.exe has a valid digital signature.
| Property | Value |
|---|---|
| Signer name | NCH Software Pty Ltd |
| Certificate issuer name | DigiCert EV Code Signing CA |
| Certificate serial number | 0572f6d5e559563497f353315b4e8147 |
VirusTotal report
None of the 71 anti-virus programs at VirusTotal detected the invsetup.exe file.
Sandbox Report
The following information was gathered by executing the file inside Cuckoo Sandbox.
Summary
Successfully executed process in sandbox.
Summary
{
"file_created": [
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\options.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\print.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\favicon.ico",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\downsort.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\vl.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\categories.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\edit.gif",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datepicker.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\side_image.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\items.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\table.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_over.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\greybg.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\ajax.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\down.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\purchase.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\suppliers.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\orders.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\reports.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_down.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\upsort.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\users.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\s.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\postfile.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\schedule.bmp",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\locations.jpg",
"C:\\Users\\cuck\\Favorites\\NCH Software Download Site.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\view.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\trash.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\darkblue.gif",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\cal.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\customers.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\arrow_blue.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\transfer.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\popup.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\sell.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\up.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datetime.js"
],
"directory_created": [
"C:\\ProgramData\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\testfolder",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web",
"C:\\Program Files (x86)\\NCH Software",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc",
"C:\\Users\\cuck\\AppData\\Roaming\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\AppData\\Roaming\\NCH Software\\Inventoria\\Backup",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\AppData\\Roaming\\NCH Software",
"C:\\ProgramData\\NCH Software\\Inventoria\\Logs",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer",
"C:\\ProgramData\\NCH Software"
],
"dll_loaded": [
"urlmon.dll",
"API-MS-Win-Security-LSALookup-L1-1-0.dll",
"srvcli.dll",
"apphelp.dll",
"LINKINFO.dll",
"Advapi32.dll",
"C:\\Windows\\system32\\DUser.dll",
"UxTheme.dll",
"C:\\Windows\\system32\\ole32.dll",
"dwmapi.dll",
"ntdll.dll",
"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll",
"slc.dll",
"ntmarta.dll",
"PROPSYS.dll",
"C:\\Windows\\syswow64\\MSCTF.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"OLEAUT32.DLL",
"SspiCli.dll",
"comctl32",
"ole32.dll",
"SHLWAPI.dll",
"CRYPTSP.dll",
"USER32.dll",
"IMM32.dll",
"API-MS-Win-Security-SDDL-L1-1-0.dll",
"XmlLite.dll",
"C:\\Windows\\system32\\xmllite.dll",
"OLEAUT32.dll",
"netutils.dll",
"SHELL32.dll",
"User32.dll",
"comctl32.dll",
"DUser.dll",
"VERSION.dll",
"kernel32.dll",
"DEVRTL.dll",
"ADVAPI32.dll",
"SETUPAPI.dll",
"ntshrui.dll",
"Cabinet.dll",
"user32.dll",
"OLEACC.dll"
],
"file_opened": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\Windows\\System32\\calc.exe",
"c:\\program files (x86)\\internet explorer\\iexplore.exe",
"C:\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData",
"C:\\Program Files (x86)\\Mozilla Firefox\\",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
"C:\\Windows\\System32\\SnippingTool.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows",
"C:\\ProgramData\\NCH Software\\Inventoria\\Logs",
"C:\\Users\\cuck\\Desktop\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\Windows\\SysWOW64\\ieframe.dll",
"c:\\program files (x86)\\nch software\\inventoria\\inventoria.exe",
"C:\\Program Files (x86)\\windows media player\\wmplayer.exe",
"C:\\Windows\\explorer.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Firefox.lnk",
"C:\\Windows\\System32\\en-US\\wfsr.dll.mui",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu",
"C:\\Windows\\System32\\snippingtool.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk",
"C:\\Windows\\System32\\oleaccrc.dll",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\Users\\Public\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini",
"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"c:\\program files (x86)\\mozilla firefox\\firefox.exe",
"C:\\Windows\\System32\\imageres.dll",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\Windows\\AppPatch\\sysmain.sdb",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\Windows\\System32\\WFS.exe",
"C:\\Windows\\System32\\StikyNot.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini",
"C:\\Program Files (x86)\\nch software\\inventoria\\inventoria.exe",
"C:\\Users\\cuck\\AppData\\Roaming",
"C:\\Program Files (x86)\\windows media player\\en-US\\wmplayer.exe.mui",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini",
"C:\\Program Files (x86)",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Python 2.7",
"C:\\Users\\Public\\Desktop",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db",
"C:\\Program Files (x86)\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk",
"C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite",
"C:\\Program Files (x86)\\NCH Software",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk",
"C:\\Users",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db",
"C:\\Windows\\System32\\xpsrchvw.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\Users\\desktop.ini",
"C:\\Windows\\System32\\mspaint.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk",
"C:\\Users\\cuck",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db",
"C:\\ProgramData\\NCH Software",
"C:\\Windows\\System32\\WFSR.dll",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs",
"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web",
"C:\\Windows\\System32\\rundll32.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini",
"C:\\Users\\cuck\\AppData",
"C:\\Windows\\SysWOW64\\",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini",
"C:\\Users\\cuck\\Desktop",
"C:\\Windows\\System32\\en-US\\calc.exe.mui",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games",
"C:\\Windows\\System32\\cmd.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\Users\\Public",
"C:\\ProgramData\\Microsoft",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini",
"C:\\Windows\\Branding\\ShellBrd\\shellbrd.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"c:\\program files (x86)\\internet explorer\\en-US\\iexplore.exe.mui",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk",
"C:\\Windows\\System32\\displayswitch.exe",
"C:\\Windows\\System32\\mstsc.exe"
],
"file_copied": [
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoriasetup_v4.03.exe"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe"
]
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xvid\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.flac",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\ExpressPoints",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0F4DC93AAA8AD1D448BC4E6A207F4FE0",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.mkv\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mkvfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\11E2BA15171FE704B98E7505E58D7749",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F356843B045CC0A4BA0D83C1D85AAAFD",
"HKEY_CURRENT_USER\\Software\\Classes\\.mpeg",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\Shell\\Convert file type",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M4A\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\ExpressBurn",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\NCHeditvideo\\command",
"HKEY_CLASSES_ROOT\\.dss",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CB2182A03B6B11341A1F09A021991CE1",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.exr",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\SuiteUsage",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CF65AB832507EDB4BB357F9D8E0431BD",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.cdo",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.npp\\userchoice",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.gsm\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.apj",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\DrawPad",
"HKEY_CURRENT_USER\\Software\\Classes\\wdpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.ape",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.rar\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.mpeg2\\userchoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mpeg2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\bz2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Switch",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Applications\\explorer.exe\\TaskbarExceptionsIcons",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.flac\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A558E619ABC4CE5479C1DA5070EFBF81",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP3\\shell\\NCHeditsound",
"HKEY_CLASSES_ROOT\\.arw",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\.odt",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Switch",
"HKEY_CURRENT_USER\\Software\\Classes\\.ape",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.apj",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\863CA21BBA4DFCE489FDF96EAB898616",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Doxillion",
"HKEY_CLASSES_ROOT\\.rar",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile\\shell",
"HKEY_CLASSES_ROOT\\.raf",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.caf\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\18F5DB38C45303843B06B1B5025E4820",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\exrfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\Shell\\NCHconvertdoc\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C4040CC509FB0DC4886F590DDF6B6132",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\.3gp",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9E40FDB6330EBA242A4BD5F4FDD0B803",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ape\\UserChoice",
"HKEY_CLASSES_ROOT\\.wpd",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertdoc\\command",
"HKEY_CLASSES_ROOT\\.wps",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\.3g2",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\Shell\\NCHextract\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tiff",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.mpdp",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B06071FE021ECB04E8B3BF1E39AD5BB3",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\drpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\.nrw",
"HKEY_CLASSES_ROOT\\Folder",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D3541DFF9B79C584284E8981624C04CB",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5E429E5BC27530F4786481EC687D9EC9",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WAV\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.shn",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.png",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Products\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\gzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.aac",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MOV\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.bmp",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pngfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\NCHburn",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.cdo\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Prism",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.ddp",
"HKEY_CLASSES_ROOT\\.divx",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpdfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Products\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rarfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}",
"HKEY_CURRENT_USER\\Software\\Classes\\.ogv",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.tga\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.oga",
"HKEY_CURRENT_USER\\Software\\Classes\\.ogg",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.cab",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.m2ts",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\89BBBC8A0D32B014696C4BA3C20CDD34",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.wp\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.srw\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gsm\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\7zfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9753E3A35E3BDFB468DF95B5D19C8A04",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INTERNET_SHELL_FOLDERS",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Disketch",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.exr",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.divx\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1C1ED53B8F25FD248955C15232E46886",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StuckRects2",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\NCHeditsound",
"HKEY_CLASSES_ROOT\\.tar.gz",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.rar",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\84BBAC70FB00B6046881B55CB3122F0F",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.raf",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wav",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}",
"HKEY_CLASSES_ROOT\\.asf",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Switch",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\crwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Software\\ExpressPoints",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\VideoPad",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\arwfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.dng",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5B5C8B2FB95B57147954C18085D53ACE",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\040E2A370D6DB2F45AE45A0032BC2179",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\ExpressAnimate",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WAV\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\Shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_CURRENT_USER\\Software\\Classes\\.wdp",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Convert sound file",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\73964AA699D5B5140ADC41ED3F7DB38A",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7FE547D6F0D72534A80F89C4AB727618",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M4A\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{04731B67-D933-450a-90E6-4ACD2E9408FE}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.TTS\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vocfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\Shell\\NCHextract\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\sr2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.divx",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.erf\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP4\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cr2\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\Edit video file",
"HKEY_CLASSES_ROOT\\.wma",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\crwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.nrw",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.vob",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ds2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\caffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.avi",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\Shell\\Convert file type",
"HKEY_CURRENT_USER\\Software\\Classes\\.au",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Pixillion",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3G2\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LDAP",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\Desktop\\NameSpace\\DelegateFolders",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile\\shell",
"HKEY_CLASSES_ROOT\\.ape",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ddpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\NCHconvertsound",
"HKEY_CLASSES_ROOT\\.exr",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.nef\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ds2file",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.tar.gz",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.dv",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rw2file\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.avi",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cr2file\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\Shell\\Extract with Express Zip",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\divxfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\Edit video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Windows.IsoFile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AU\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tga\\UserChoice",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.nrw\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CDBF699A8F2EAC2438564C3D50E9E638",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\CABFolder\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dss\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M2TS\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dctfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rtffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\odtfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.dv",
"HKEY_CURRENT_USER\\Software\\Classes\\.vox",
"HKEY_CURRENT_USER\\Software\\Classes\\.7z",
"HKEY_CURRENT_USER\\Software\\NCH Software\\ExpressZip",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\ExpressBurn",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\neffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\ExpressZip",
"HKEY_CURRENT_USER\\Software\\Classes\\.vob",
"HKEY_CURRENT_USER\\Software\\Classes\\.voc",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.7z\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.bz2",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\Shell\\Convert sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vpjfile\\shell",
"HKEY_CLASSES_ROOT\\.bmp",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\Shell\\NCHconvertdoc\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.npp",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4FE19F224928A59468049F045950CB08",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\84C584688CFC74A4E9D36E5EE2E02FA7",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vpjfile",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\PropertyHandlers\\.lnk",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\62293D511DB84E5489074C5AFA18E882",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.wpd\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\Desktop\\NameSpace",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.jp2\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\Shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nrwfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.doc",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4626147D107665540A84D43A5908E74D",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ADTS\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.mkv",
"HKEY_CLASSES_ROOT\\.pdf",
"HKEY_CURRENT_USER\\Software\\Classes\\.jpeg",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apjfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.ts",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8ECC347096FA78C4E8291F449F71E16E",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nppfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\srwfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.tar.gz\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vocfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\http\\OpenWithProgids",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\bz2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wp\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.htm",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jp2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.docx",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\DelegateFolders",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shn\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\Shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile",
"HKEY_CLASSES_ROOT\\.gsm",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Paint.Picture\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\717591555BCB1604BA9777E8A55D0E41",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\Edit video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.TTS\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.gz\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.flac\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ADTS\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.bmp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{450D8FBA-AD25-11D0-98A8-0800361B1103}",
"HKEY_CLASSES_ROOT\\Outlook.Application.12",
"HKEY_CLASSES_ROOT\\Outlook.Application.11",
"HKEY_CLASSES_ROOT\\Outlook.Application.10",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.aif",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\Edit sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\TIFImage.Document\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.tgz\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\voxfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wp",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wma",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpeg2\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9BA984AD4F03E284382FFBB7A68BEE27",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\NCHslideshow\\command",
"HKEY_CLASSES_ROOT\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP3\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{645FF040-5081-101B-9F08-00AA002F954E}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\3D197E722531D614AB40C182904D9A31",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dctfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B4BBDDC88CEE4DD439E8BB261CE222A8",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\.wpd",
"HKEY_CURRENT_USER\\Software\\Classes\\.pdf",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\(Default)",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Settings",
"HKEY_CURRENT_USER\\Software\\Classes\\.wps",
"HKEY_CURRENT_USER\\Software\\Classes\\.shn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.bz2",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.dng\\userchoice",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\MixPad",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\DirectUI",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\Clsid",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3GP\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tgzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\Convert sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\shnfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\Shell\\NCHconvertdoc\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\NCHburn\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\shnfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tga",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\CurVer",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docfile\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.vob\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.npp",
"HKEY_CLASSES_ROOT\\.rw2",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tgz",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tgafile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jpegfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F21868A51A175874BB819DCA5FAA40A3",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F41A458014D57E54E8DBD0B0CBC361A2",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Scheduler",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell",
"HKEY_CLASSES_ROOT\\.pgf",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\17E23EF6C775D324DB90E0E2B7D1CA72",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dv\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tar.gzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\Convert video file",
"HKEY_CLASSES_ROOT\\.htm",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\586A8930D8DF3B6489614C37910BFCF5\\Features",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.dct\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wps",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rar\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wpd",
"HKEY_CLASSES_ROOT\\.flac",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8020CF43278B2644190F51544810251E",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cdofile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Registration",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{59031a47-3f72-44a7-89c5-5595fe6b30ee}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E85E64F0A7FC58E47A87E5AB98A6F2DD",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B1D5EA6004F809D48B117CE563261011",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Doxillion",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\arwfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}",
"HKEY_CURRENT_USER\\Software\\Classes\\.erf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\srffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\TIFImage.Document\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{4336a54d-038b-4685-ab02-99bb52d3fb8b}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\285499F23409ED14FB4A01230F5DFA91",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AU\\shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7FEB01D34D0F67E4F9CD810B432C1B91",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4514EC211C8947C4B9BA24F353AFFD50",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\67C12EF40671B7342A2F990919031A57",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vox\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\giffile\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\NCHeditvideo\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\giffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.vpj",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\315C767EFC72D8445B1D2D16F72653F0",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MPEG\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.srf\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apefile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rw2\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nrwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.wav",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.doc\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rtffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\VideoPad",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\AD21E12039BB3BC47B1938BC4ABDFEE2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\webpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\shell\\NCHburn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vpjfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dssfile\\shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\ExpressAnimate",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\WavePad",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.caf\\UserChoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{031E4825-7B94-4dc3-B131-E946B44C8DD5}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.gz",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\shell\\NCHslideshow",
"HKEY_CLASSES_ROOT\\.aac",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tar.gzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Disketch",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\30FAECE2400494D4FB69207288EB5B73",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dssfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FFFA6DF7EA9EDFC45A1F02FE6DF8F067",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\87C48B95924E3294FBC1766C9225DD0C",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.gsm",
"HKEY_CURRENT_USER\\Software\\Classes\\.gsm",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.srw\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tar.gz\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pgffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.doc\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.docx",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ds2file\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ddpfile\\shell\\open",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.ape\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\erffile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.exr\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\deprojfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pgffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jpegfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\Edit sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\.caf",
"HKEY_CURRENT_USER\\Software\\Classes\\.cab",
"HKEY_CURRENT_USER\\Software\\Classes\\.webp",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wdpfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wdpfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pngfile\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dngfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.webm",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Convert file type",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Scribe",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\MixPad",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.vpj\\userchoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.voc\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Software",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.mov",
"HKEY_CURRENT_USER\\Software\\Classes\\.vpj",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.ddp",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{e345f35f-9397-435c-8f95-4e922c26259e}",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\srwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\NCHeditvideo\\command",
"HKEY_CLASSES_ROOT\\.jpg",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bz2\\UserChoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\Create slideshow",
"HKEY_CLASSES_ROOT\\http",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.erf\\userchoice",
"HKEY_CLASSES_ROOT\\AllFilesystemObjects",
"HKEY_CLASSES_ROOT\\.tga",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell",
"HKEY_CLASSES_ROOT\\.tgz",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.xvid",
"HKEY_CLASSES_ROOT\\.jp2",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\Shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\Shell\\Extract with Express Zip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\gsmfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tar",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\Shell\\NCHconvertdoc\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\103857F24A2EDA54A800A41FA570861F",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\296744B7EBFEB2741A47781AE6E32269",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\Shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tar.gz",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.mrw\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell",
"HKEY_CLASSES_ROOT\\.mp4",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\DreamPlan",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vob\\UserChoice",
"HKEY_CURRENT_USER\\Software\\NCH Software\\ExpressAnimate",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Explorer",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rarfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.3gp",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\sr2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4FE462B32EFD81040A184ED17E00452B",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D38A6F5FC8262149A9FAAE8C621EE3F",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\ExpressAnimate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\VideoPad",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\CurVer",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\Shell\\NCHextract\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mrw",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.sr2\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dngfile\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.crw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpdpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\Directory\\OpenWithProgids",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WMA\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.raf\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\ExpressZip",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\NCHconvertvideo",
"HKEY_CLASSES_ROOT\\.erf",
"HKEY_CLASSES_ROOT\\.cr2",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.dv\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E116C831A95AB5B4787CE3086FE83631",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\wdpfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.srf\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\Shell\\NCHextract\\command",
"HKEY_CLASSES_ROOT\\.srf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3G2\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\Shell\\NCHextract",
"HKEY_CLASSES_ROOT\\.srw",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AU\\Shell",
"HKEY_CLASSES_ROOT\\FirefoxURL-E7CF176E110C211B",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jp2\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\Shell\\NCHconvertdoc\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\002F6EFFA8A0A40498F3035BD153685A",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.deproj",
"HKEY_CLASSES_ROOT\\.sr2",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0FD387D006FD9734FA65B249F36DE42A",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\EEF8AA9EB45B5DB4BBE46B8634C910CD",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Scribe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanServer\\DefaultSecurity",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\NCHconvertvideo\\command",
"HKEY_CLASSES_ROOT\\.mov",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\DelegateFolders",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Crescendo",
"HKEY_CLASSES_ROOT\\.au",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions",
"HKEY_CURRENT_USER\\Software\\Classes\\.ts",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\Edit video file",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\AccessProviders",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WAV\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.pgf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AIFF\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.wma",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mrw\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tar\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9F5ED6B416EF0A1448D94799D0FF20BA",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pgf\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Disketch",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.aif",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\NCHeditvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WMA\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.nef",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Scribe",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\flacfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CLASSES_ROOT\\.wp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\Shell\\NCHconvertimage",
"HKEY_CLASSES_ROOT\\.rtf",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\PhotoStage",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\.cr2",
"HKEY_CLASSES_ROOT\\.m4v",
"HKEY_CURRENT_USER\\Software\\Classes\\.gif",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\spjfile",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\669C9DC1419C0F240B35B36B99AAB50C",
"HKEY_CLASSES_ROOT\\.m4a",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E40FDF839772BEB41AC977860DBB4853",
"HKEY_CLASSES_ROOT\\.caf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\xvidfile\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.cab",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\nchsetup.exe",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B690B72A999998C47B5F93C94A8D43B2",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jpegfile\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\srffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MPEG\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\DrawPad",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wdpfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cdofile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7C0477DE66D1A6749864FCE02A6DCB6C",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sr2\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.raf\\UserChoice",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.spj\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gz\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.arw\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ADTS\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F05C8358C56DAD54BB81D0A11DD52F41",
"HKEY_CURRENT_USER\\Software\\Classes\\.dct",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4486F7CE8F022FB4EB0154C5226C27A0",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jpegfile\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.rw2",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AVI\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\spjfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\Shell\\Extract with Express Zip",
"HKEY_CLASSES_ROOT\\.tar",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.dss\\userchoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\(Default)",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Doxillion",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\nchsetup.exe",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ASF\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\63B1AF366905AF641BA514CCBAE803C4",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\Shell\\Convert file type",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D0CBB37A94C46943A90AC5008CF1CC9",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_LOCAL_MACHINE\\System\\Setup",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7814D91294731FF4DBBB840810BEB3BB",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mrwfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nppfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\.gz",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP3\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.webp",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.nrw\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.mp3",
"HKEY_CURRENT_USER\\Software\\Classes\\.mp4",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mp4",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AVI\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mp3",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.crw\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Prism",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D04063BE69797D4D8505462827A0D19",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mpg",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tarfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.spj",
"HKEY_CLASSES_ROOT\\.3g2",
"HKEY_CURRENT_USER\\Software\\NCH Software\\WavePad",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apjfile\\shell",
"HKEY_CLASSES_ROOT\\.mrw",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.mpg",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\ExpressBurn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\ExpressPoints",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpeg2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\raffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.mpdp\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.bz2\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MOV\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A0256FF64030E0746A4AA95D3FFD0BE4",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell",
"HKEY_CLASSES_ROOT\\.nef",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.voc\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.drp",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\BE0BD5097A638224EB0DAAE870267F03",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.rtf",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FBEAAA6C37E8AF24B87AAEA0047433BD",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\.tgz",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\Shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ds2file\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.divx",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\Shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Classes\\.tga",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Windows.IsoFile\\shell\\NCHburn",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.spj",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.7z\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CE5B971A0DBB8FD4F83AE0DADC348104",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Pixillion",
"HKEY_CLASSES_ROOT\\.gz",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CLASSES_ROOT\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Classes\\.html",
"HKEY_CLASSES_ROOT\\Interface\\{618736E0-3C3D-11CF-810C-00AA00389B71}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ddpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tgzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\04C56B5D827A9194FA2CBFD014EAD0DA",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.webp\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\shell\\NCHconvertvideo",
"HKEY_CLASSES_ROOT\\.ds2",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.cr2\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mov",
"HKEY_CLASSES_ROOT\\.gif",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\webpfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\95E2C34402A93A14FA8CB3420B85375C",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\Shell\\NCHconvertsound",
"HKEY_CLASSES_ROOT\\.webp",
"HKEY_CLASSES_ROOT\\.webm",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mkvfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F591EF48DE97A00428A5BC1AFFFAA868",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vobfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\giffile\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Paint.Picture\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\xvidfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\Edit video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpsfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\Shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.docx",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apefile\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\Shell\\NCHconvertdoc\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.caf",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.ddp\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\Shell\\Extract with Express Zip",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.iso",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.iso",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\odtfile\\shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\.nef",
"HKEY_CLASSES_ROOT\\.iso",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pngfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.rtf",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.pgf",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\NCHconvertsound",
"HKEY_CLASSES_ROOT\\.m2ts",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cr2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\958C4A0DE6C8D5C428C6E9D875BC33B6",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tgz\\UserChoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg 2",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\NCH Software\\ExpressBurn",
"HKEY_CURRENT_USER\\Software\\Classes\\.mkv",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Switch",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FF9FDEA72CD9DDC47A6DAB85F9F76B81",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\giffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.wp",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.divx\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.ds2",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP4\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Installer\\Products\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Software\\NCH Software\\VideoPad",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dctfile\\shell",
"HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Classes\\.m4v",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5B04950B5EC5C924B8F428B5484A2720",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.dss",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\92F9143E715DEF045A539256438E41FB",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\16AC40BE991DF1643B2800729063B2F9",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\AE5A0040C41ACA642AF6DB16F4D2F638",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.tiff",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\drpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\Edit video file",
"HKEY_CLASSES_ROOT\\.ts",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ThumbnailCache",
"HKEY_CLASSES_ROOT\\.xvid",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rw2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell",
"HKEY_CURRENT_USER\\Software\\NCH Software\\PhotoStage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.7z",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\DreamPlan",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dng\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.jp2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pngfile\\shell\\NCHslideshow",
"HKEY_CLASSES_ROOT\\.bz2",
"HKEY_CLASSES_ROOT\\.aiff",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.drp",
"HKEY_CLASSES_ROOT\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\InProcServer32",
"HKEY_CLASSES_ROOT\\.nrw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cdofile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.m4v",
"HKEY_CURRENT_USER\\Software\\Classes\\.xvid",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.3g2",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AIFF\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpdpfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\Shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\90860AAA7BD3DE34EB32330DD29CAD62",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\PropertyBag",
"HKEY_CLASSES_ROOT\\.mp3",
"HKEY_CURRENT_USER\\Software\\Classes\\.sr2",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rtffile\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ASF\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\flacfile\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.odt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\Shell\\Convert file type",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\nchsetup.exe",
"HKEY_CURRENT_USER\\Software\\Classes\\.srf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dssfile",
"HKEY_CLASSES_ROOT\\.vox",
"HKEY_CLASSES_ROOT\\.mpg",
"HKEY_CLASSES_ROOT\\.vob",
"HKEY_CLASSES_ROOT\\.voc",
"HKEY_CURRENT_USER\\Software\\Classes\\.srw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Paint.Picture\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\DefaultIcon",
"HKEY_CLASSES_ROOT\\Directory",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AIFF\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Registration\\NCH",
"HKEY_CLASSES_ROOT\\.avi",
"HKEY_CLASSES_ROOT\\.mpeg2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0EF52818FCE3E7B488427C1F8266654E",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\voxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.cr2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1E82F31DC0D05AA4CB291B7BAA23FC8E",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Crescendo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A7E9995902A24964C9C5D461E1C86F19",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.aiff",
"HKEY_CURRENT_USER\\Software\\Classes\\wdpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\NCHeditvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0411990C889EE9B47BB0B5D356564877",
"HKEY_CURRENT_USER\\Software\\Classes\\.crw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.jpeg",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Blocked",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.crw",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Scribe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7BF7ABF4D25C03F4582D4BC3082FB208",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.sr2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\nchsetup.exe",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\Shell\\Convert file type",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\.cdo",
"HKEY_CURRENT_USER\\Software\\Classes\\.tar",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.srw",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.srf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.odt",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\NCHextract\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.jp2",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Disketch",
"HKEY_CLASSES_ROOT\\.shn",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.m4a",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.dss",
"HKEY_CURRENT_USER\\Software\\Classes\\.m4a",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AVI\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D725CB8E57307E64EB574E04214D8B5F",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Prism",
"HKEY_CURRENT_USER\\Software\\NCH Software\\MixPad",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.jpg",
"HKEY_CURRENT_USER\\Software\\Classes\\.dng",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\.jpg",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ASF\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.mrw",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.ds2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
"HKEY_CURRENT_USER\\Software\\Classes\\.rw2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{11016101-E366-4D22-BC06-4ADA335C892B}",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MOV\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\NCHslideshow\\command",
"HKEY_CLASSES_ROOT\\.png",
"HKEY_CLASSES_ROOT\\.doc",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5E3DAE67887931944BCD7171908FA775",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\(Default)",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\965742E8F65116F4BB2CB01341464FA7",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.gif",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\CABFolder\\shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Windows.IsoFile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Paint.Picture\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\95EE473833000D6409127D1B85882AC9",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{871C5380-42A0-1069-A2EA-08002B30309D}",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\DreamPlan",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.ds2\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\895805CC90C04694887EF6BD140A622D",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mrwfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.arw\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MPEG\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3GP\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\Shell\\NCHconvertsound",
"HKEY_CLASSES_ROOT\\.html",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.asf",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\75B368B60C908BA4E87C31F66B02F3F0",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Explorer",
"HKEY_CURRENT_USER\\Software\\Classes\\.asf",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.pgf\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\Edit sound file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.crw\\UserChoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{9343812e-1c37-4a49-a12e-4b2d810d956b}",
"HKEY_CURRENT_USER\\Software\\NCH Software\\DrawPad",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vobfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.xvid\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Crescendo",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Prism",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jp2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dvfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\gsmfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.mpeg2",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.apj\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PropertyBag",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mkv\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpdfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.doc",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\PhotoStage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\TIFImage.Document\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9DD74C0626DC33C479C1929714AB5295",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\53F08364FFD17F14B8FD7CA7F52FAE76",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\Shell\\NCHconvertdoc\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\neffile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.tar\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Sharing",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.voc",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\raffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\Convert sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docxfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mpeg",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.vox",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\spjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D5FD8239A83FE564F97379EA15CE8CB6",
"HKEY_CLASSES_ROOT\\.dv",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\2FA90A429E82313489DAA2E2C2F0872C",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.TTS\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Pixillion",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3G2\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M4A\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.png",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7636A94AA21EDBB48B6AFFB17E5907B8",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M2TS\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\ExpressPoints",
"HKEY_CURRENT_USER\\Software\\Classes\\.arw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.arw",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\Shell",
"HKEY_CLASSES_ROOT\\.dng",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\deprojfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\33AB3CD4D27277545B5A93CD4ECB96B4",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\caffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\89DF671CDA74E9D4EB10275B10D5CF3F",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9D22CD4619F5DBC499A083AAD70FE7B3",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{daf95313-e44d-46af-be1b-cbacea2c3065}",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Edit video file",
"HKEY_CLASSES_ROOT\\.3gp",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\exrfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.wps\\userchoice",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\ExpressZip",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.deproj\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.mpeg",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\Directory",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Crescendo",
"HKEY_CURRENT_USER\\Software\\Classes\\.flac",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exr\\UserChoice",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.vox\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3GP\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\18D84E9490A485948A17A1F02CDAA62A",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nppfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tarfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\MixPad",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\335F6F64CD461D9469519574D34757EB",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.aac",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wdp",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{26EE0668-A00A-44D7-9371-BEB064C98683}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.tiff",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpsfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\divxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\Shell\\Convert file type",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1A0857155A8EF604FA5D1648CF382DC7",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.rw2\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\odtfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0A191B45599EEB74CA305184EA3C2A94",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.webp\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_CURRENT_USER\\Software\\Classes\\.raf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dvfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\Shell\\NCHextract\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.rar",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\Shell\\NCHextract\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\Burn with Express Burn",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpeg2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.dct",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.ogg",
"HKEY_CLASSES_ROOT\\.aif",
"HKEY_CLASSES_ROOT\\.oga",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{89D83576-6BD1-4c86-9454-BEB04E94C819}",
"HKEY_CLASSES_ROOT\\.ogv",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mkv",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Pixillion",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.drp\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\3C68656E520593A45925ADFB41F821B5",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mpdp",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.erf",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Service",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
"HKEY_CURRENT_USER\\Software\\Classes\\.aiff",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WMA\\shell\\NCHeditsound",
"HKEY_CLASSES_ROOT\\.jpeg",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M2TS\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wpd\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.au",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8691BCC36FF121849A90B085BFAF5E5E",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\WavePad",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\gzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docxfile\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\CABFolder\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\Shell\\Convert file type",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\deprojfile",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\Shell",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\WavePad",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\Shell\\NCHextract\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AU\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\7zfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\.m2ts",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpdpfile",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wps\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dssfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FE056816E41FD2F4CACD03E7A2CA2E6E",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\DrawPad",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.deproj",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Blocked",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP4\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\erffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\PhotoStage",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Settings",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\drpfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.nef\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\NCHconvertvideo\\command",
"HKEY_CLASSES_ROOT\\.7z",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.shn\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Windows.IsoFile\\shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tgafile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C1EF68F348457B246A0AD0C18B3079AF",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\NCHeditsound",
"HKEY_CLASSES_ROOT\\.wav",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Doxillion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ds2\\UserChoice",
"HKEY_CLASSES_ROOT\\Outlook.Application",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell",
"HKEY_CURRENT_USER\\Software\\NCH Software\\DreamPlan",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\Shell\\NCHextract\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\034A8F8E06031EF46BCB4C10469098E5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
],
"file_moved": [
[
"C:\\ProgramData\\NCH Software\\Inventoria\\Tax.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\Tax.dat"
],
[
"C:\\ProgramData\\NCH Software\\Inventoria\\Options.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\Options.dat"
],
[
"C:\\ProgramData\\NCH Software\\Inventoria\\Company.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\Company.dat"
],
[
"C:\\ProgramData\\NCH Software\\Inventoria\\Order.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\Order.dat"
]
],
"file_written": [
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\options.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\print.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\favicon.ico",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\downsort.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\vl.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\categories.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\edit.gif",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datepicker.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\side_image.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\items.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\table.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_over.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\greybg.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\ajax.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\down.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\purchase.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\suppliers.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\orders.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\reports.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_down.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\upsort.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\users.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\s.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\postfile.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\schedule.bmp",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\locations.jpg",
"C:\\Users\\cuck\\Favorites\\NCH Software Download Site.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\view.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\trash.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\darkblue.gif",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\cal.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\customers.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\arrow_blue.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\transfer.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\popup.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\sell.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\up.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datetime.js"
],
"regkey_deleted": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupCollapseState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\_UserSpecific",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Software\\InstalledBy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\UserSpecific",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Software\\_InstalledBy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\InventoriaInstall",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\ItemOrder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\ItemPos800x600x96(1)"
],
"file_deleted": [
"",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\InventoriaCounts.txt"
],
"directory_removed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\testfolder"
],
"file_exists": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\Python27\\pythonw.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\Users\\cuck\\Desktop",
"C:\\cuckoo_1788.ini",
"C:\\Python27\\python.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite",
"C:\\Program Files (x86)\\NCH Software",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc",
"C:\\Users\\Public",
"C:\\Users",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs",
"C:\\ProgramData\\NCH Software\\Inventoria\\Logs",
"C:\\Windows\\inf\\",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\Windows\\SysWOW64\\ieframe.dll",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe",
"C:\\Users\\Public\\Desktop\\NCH Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\NCH Software\\Program Files\\Inventoria",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"C:\\Users\\cuck",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ThumbCacheToDelete",
"C:\\ProgramData\\NCH Software",
"C:\\Users\\cuck\\Favorites\\NCH Software Download Site.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\Users\\Public\\Desktop",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe\" -installer \"C:\\Users\\cuck\\AppData\\Local\\Temp\\c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin\" -instdata \"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat\"",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe -installer \"C:\\Users\\cuck\\AppData\\Local\\Temp\\c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin\" -instdata \"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat\""
],
"mutex": [
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_32.db!dfMaintainer",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_256.db!dfMaintainer",
"Local\\Shell.CMruPidlList",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_sr.db!dfMaintainer",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1024.db!dfMaintainer",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!ThumbnailCacheInit",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_96.db!dfMaintainer",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex"
],
"file_failed": [
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\Users\\cuck\\Desktop\\NCH Suite.lnk\\desktop.ini",
"C:\\Users\\cuck\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\Users\\Public\\Desktop\\NCH Software.lnk",
"C:\\ProgramData\\Microsoft\\desktop.ini",
"C:\\Users\\Public\\Desktop\\NCH Software.lnk\\desktop.ini",
"C:\\Users\\cuck\\Desktop\\NCH Suite.lnk",
"C:\\cuckoo_1788.ini",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk\\desktop.ini",
"C:\\Users\\cuck\\Desktop\\NCH Software.lnk",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\Desktop\\NCH Software.lnk\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db"
],
"guid": [
"{49f371e1-8c5c-4d9c-9a3b-54a6827f513c}",
"{a4341687-7593-47aa-9554-4b0ffc8b2214}",
"{00021401-0000-0000-c000-000000000046}",
"{688c934d-0c26-40f6-8d29-d56d72c76b48}",
"{2faba4c7-4da9-4013-9697-20cc3fd40f85}",
"{660b90c8-73a9-4b58-8cae-355b7f55341b}",
"{9b63616c-36b2-46bc-959f-c1593952d19b}",
"{1a1f4206-0688-4e7f-be03-d82ec69df9a5}",
"{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}",
"{42aedc87-2188-41fd-b9a3-0c966feabec1}",
"{000214f9-0000-0000-c000-000000000046}",
"{00000000-0000-0000-c000-000000000046}",
"{00000146-0000-0000-c000-000000000046}",
"{76765b11-3f95-4af2-ac9d-ea55d8994f1a}",
"{871c5380-42a0-1069-a2ea-08002b30309d}",
"{000214e6-0000-0000-c000-000000000046}",
"{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}",
"{2fb499a3-cfce-480f-a5f3-2453db7a2b7a}",
"{00000323-0000-0000-c000-000000000046}",
"{75121952-e0d0-43e5-9380-1d80483acf72}",
"{ab8902b4-09ca-4bb6-b78d-a8f59079a8d5}",
"{1f3427c8-5c10-4210-aa03-2ee45287d668}",
"{f676c15d-596a-4ce2-8234-33996f445db1}",
"{46a6eeff-908e-4dc6-92a6-64be9177b41c}",
"{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}",
"{50ef4544-ac9f-4a8e-b21b-8a26180db13f}",
"{edb5f444-cb8d-445a-a523-ec5ab6ea33c7}"
],
"file_read": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk",
"C:\\Users\\Public\\Desktop\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk",
"C:\\Users\\cuck\\Desktop\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk",
"C:\\Windows\\SysWOW64\\ieframe.dll",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk",
"C:\\Users\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Firefox.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\Users\\Public\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini",
"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini",
"C:\\Program Files (x86)\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0A191B45599EEB74CA305184EA3C2A94\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9F5ED6B416EF0A1448D94799D0FF20BA\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E85E64F0A7FC58E47A87E5AB98A6F2DD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.VagreargRkcybere.Qrsnhyg",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParsingName",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Gnfx Fpurqhyre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\InProcServer32\\LoadWithoutCOM",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Erzbgr Qrfxgbc Pbaarpgvba.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{daf95313-e44d-46af-be1b-cbacea2c3065}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\tarfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{N4P35507-1P2S-1P25-2NO6-54NS1P5196P3}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aiff\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\KCF Ivrjre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FF9FDEA72CD9DDC47A6DAB85F9F76B81\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\odtfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpeg\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D04063BE69797D4D8505462827A0D19\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName",
"HKEY_CURRENT_USER\\tgzfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\67C12EF40671B7342A2F990919031A57\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Jvaqbjf Rnfl Genafsre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CABFolder\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\StreamResourceType",
"HKEY_CURRENT_USER\\neffile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AVI\\shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Favorites",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\90860AAA7BD3DE34EB32330DD29CAD62\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp4\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Jvaqbjf Sverjnyy jvgu Nqinaprq Frphevgl.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MPEG\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Znvagranapr\\Erzbgr Nffvfgnapr.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.wma\\shell\\(Default)",
"HKEY_CURRENT_USER\\caffile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Znvagranapr\\Perngr Erpbirel Qvfp.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
"HKEY_CURRENT_USER\\dngfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\FavoritesRemovedChanges",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\vFPFV Vavgvngbe.yax",
"HKEY_CURRENT_USER\\voxfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\P:\\Hfref\\phpx\\NccQngn\\Ybpny\\Grzc\\a1f\\apufrghc.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Rkcerff Ohea PQ, QIQ be Oyh-Enl.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{67SO9SQ4-4776-616P-S27S-5PS35769Q9Q8}",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\wdpfile\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Qvfx Pyrnahc.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemFolderPathDisplayNarrow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\296744B7EBFEB2741A47781AE6E32269\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B4BBDDC88CEE4DD439E8BB261CE222A8\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\.pdf\\(Default)",
"HKEY_CURRENT_USER\\wpsfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Jvaqbjf CbjreFuryy Zbqhyrf.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.iso\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClearRecentDocsOnExit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_CURRENT_USER\\.dng\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0411990C889EE9B47BB0B5D356564877\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\3C68656E520593A45925ADFB41F821B5\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\InfoTip",
"HKEY_CURRENT_USER\\crwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D3541DFF9B79C584284E8981624C04CB\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_NotifyNewApps",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Zngu Vachg Cnary.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4v\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Pbzzba Svyrf\\Zvpebfbsg Funerq\\Vax\\FuncrPbyyrpgbe.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bmp\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FBEAAA6C37E8AF24B87AAEA0047433BD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\cevagznantrzrag.zfp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Security",
"HKEY_CURRENT_USER\\rarfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\.ogg\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5\\DefaultFeature",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\wdpfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8691BCC36FF121849A90B085BFAF5E5E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\divxfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E40FDF839772BEB41AC977860DBB4853\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Roamable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.ErzbgrQrfxgbc",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\ehome\\ehres.dll,-100",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\FavoritesChanges",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\jpegfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.htm\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\034A8F8E06031EF46BCB4C10469098E5\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpg\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mov\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\FavccvatGbby.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wav\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Jvaqbjf AG\\Npprffbevrf\\jbeqcnq.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\System.NamespaceCLSID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8020CF43278B2644190F51544810251E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\AllowFileCLSIDJunctions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.TTS\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4626147D107665540A84D43A5908E74D\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir",
"HKEY_CURRENT_USER\\docxfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C1EF68F348457B246A0AD0C18B3079AF\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\vobfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{P1P6S8NP-40N3-0S5P-146S-65N9QP70OOO4}",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionLow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\LocalizedName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Taskband\\FavoritesRemovedChanges",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{551R32Q6-S1Q9-Q5SP-334P-3728R154N349}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.srf\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\95E2C34402A93A14FA8CB3420B85375C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\efgehv.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\JnirCnq Fbhaq Rqvgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\{b155bdf8-02f0-451e-9a26-ae317cfd7779}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\StreamResourceType",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{8NN47365-O2O3-1961-69RO-S866R376O12S}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_CURRENT_USER\\.cr2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Icon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU Size",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{S84090O0-S544-1NRN-246O-S1Q0Q906OQ9Q}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INTERNET_SHELL_FOLDERS\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Category",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Pnyphyngbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{772S366N-R591-9RR1-P344-S9543725R2QS}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.ZrqvnCynlre32",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionLow",
"HKEY_CURRENT_USER\\.vox\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D38A6F5FC8262149A9FAAE8C621EE3F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Attributes",
"HKEY_CURRENT_USER\\pgffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7636A94AA21EDBB48B6AFFB17E5907B8\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\\GnfxOne\\Jvaqbjf Rkcybere.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Icon",
"HKEY_CURRENT_USER\\neffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\CurrentVersion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{4QO6NNNN-156Q-2988-53O4-OP8RS9840SP1}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{871C5380-42A0-1069-A2EA-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{OQ3S924R-55SO-N1ON-9QR6-O50S9S2460NP}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pyrnazte.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5E429E5BC27530F4786481EC687D9EC9\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\FolderTypeID",
"HKEY_CURRENT_USER\\raffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfNalgvzrHctenqrHV.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Jvaqbjf Rkcybere.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Icon",
"HKEY_CURRENT_USER\\apefile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Gnoyrg CP\\Jvaqbjf Wbheany.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\AlwaysShowExt",
"HKEY_CURRENT_USER\\flacfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A558E619ABC4CE5479C1DA5070EFBF81\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7814D91294731FF4DBBB840810BEB3BB\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProfilesDirectory",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Zbovyvgl Pragre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.3GP\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pnyp.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\040E2A370D6DB2F45AE45A0032BC2179\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jvaqbjf CbjreFuryy\\Jvaqbjf CbjreFuryy VFR (k86).yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Frphevgl Pbasvthengvba Znantrzrag.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{NQ9N4QRQ-047Q-NQ20-93Q4-97567333Q0PP}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Pictures",
"HKEY_CURRENT_USER\\vocfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Category",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\erpqvfp.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.ADTS\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\95EE473833000D6409127D1B85882AC9\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemPathDisplay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{208D2C60-3AEA-1069-A2D7-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0EF52818FCE3E7B488427C1F8266654E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\\GnfxOne\\Jvaqbjf Zrqvn Cynlre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\89BBBC8A0D32B014696C4BA3C20CDD34\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CF65AB832507EDB4BB357F9D8E0431BD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParentFolder",
"HKEY_CURRENT_USER\\dssfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\586A8930D8DF3B6489614C37910BFCF5\\Features\\DefaultFeature",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Fvqrone.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Flfgrz Gbbyf\\Cevingr Punenpgre Rqvgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4486F7CE8F022FB4EB0154C5226C27A0\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\giffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Vagrearg Rkcybere.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\LocalizedName",
"HKEY_CURRENT_USER\\mrwfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_LargeMFUIcons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cab\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}",
"HKEY_CURRENT_USER\\tgafile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\{35786D3C-B075-49b9-88DD-029876E11C01}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\SNTSearch.dll,-505",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Erfbhepr Zbavgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\InProcServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\InitFolderHandler",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9DD74C0626DC33C479C1929714AB5295\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
"HKEY_CURRENT_USER\\ds2file\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-20\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\002F6EFFA8A0A40498F3035BD153685A\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{374DE290-123F-4565-9164-39C4925E467B}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CABFolder\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4a\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5B04950B5EC5C924B8F428B5484A2720\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{89D83576-6BD1-4c86-9454-BEB04E94C819}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Genafpevcgvba Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rtf\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\717591555BCB1604BA9777E8A55D0E41\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Roamable",
"HKEY_CURRENT_USER\\.voc\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpg\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\abgrcnq.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\bqopnq32.rkr",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\displayswitch.exe,-320",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionHigh",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_MinMFU",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\R7PS176R110P211O",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemPathDisplayNarrow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\73964AA699D5B5140ADC41ED3F7DB38A\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9BA984AD4F03E284382FFBB7A68BEE27\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zntavsl.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\Content Type",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tar\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4FE462B32EFD81040A184ED17E00452B\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{NN198O3P-PQ8P-7QR1-98Q1-O460S637193O}",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F21868A51A175874BB819DCA5FAA40A3\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\CommonVideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\bfx.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Cnvag.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\AE5A0040C41ACA642AF6DB16F4D2F638\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AVI\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\rtffile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AU\\shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\\GnfxOne\\Vagrearg Rkcybere.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.png\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.TS\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dct\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jbeqcnq.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4514EC211C8947C4B9BA24F353AFFD50\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vob\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Jvaqbjf Rnfl Genafsre Ercbegf.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\StreamResourceType",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\MRUListEx",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached\\{1F3427C8-5C10-4210-AA03-2EE45287D668} {000214E6-0000-0000-C000-000000000046} 0xFFFF",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\aneengbe.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\giffile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Music",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7FEB01D34D0F67E4F9CD810B432C1B91\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Vairagbel Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\dssfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tiff\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Video",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C4040CC509FB0DC4886F590DDF6B6132\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TIFImage.Document\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AU\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Sharing\\UsersShareName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{7SR8Q22N-SO1Q-N8OR-01R3-6P8693961R6R}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\CommonMusic",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_CURRENT_USER\\xvidfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\16AC40BE991DF1643B2800729063B2F9\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\InitFolderHandler",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jvaqbjf CbjreFuryy\\Jvaqbjf CbjreFuryy.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\UninstallString",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7C0477DE66D1A6749864FCE02A6DCB6C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\GlobalAssocChangedCounter",
"HKEY_CURRENT_USER\\http\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0F4DC93AAA8AD1D448BC4E6A207F4FE0\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_CURRENT_USER\\docfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\P:\\Clguba27\\clguba.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\ArgCebw.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jvaqbjf CbjreFuryy\\Jvaqbjf CbjreFuryy (k86).yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D725CB8E57307E64EB574E04214D8B5F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\DisableProcessIsolation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Flfgrz Erfgber.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Stream",
"HKEY_CURRENT_USER\\.webm\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Punenpgre Znc.yax",
"HKEY_CURRENT_USER\\webpfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.TrggvatFgnegrq",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CE5B971A0DBB8FD4F83AE0DADC348104\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MP3\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\89DF671CDA74E9D4EB10275B10D5CF3F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\jp2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Pbzznaq Cebzcg.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.WAV\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\863CA21BBA4DFCE489FDF96EAB898616\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Category",
"HKEY_CURRENT_USER\\TIFImage.Document\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1E82F31DC0D05AA4CB291B7BAA23FC8E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B1D5EA6004F809D48B117CE563261011\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut",
"HKEY_CURRENT_USER\\wpfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_CURRENT_USER\\.flac\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Rirag Ivrjre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Gnoyrg CP\\GnoGvc.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\P:\\Hfref\\Choyvp\\Qrfxgbc\\APU Fhvgr.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\jp2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\freivprf.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\\GnfxOne\\Sversbk.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Qngn Fbheprf (BQOP).yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\315C767EFC72D8445B1D2D16F72653F0\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Security",
"HKEY_CURRENT_USER\\.xvid\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Icon",
"HKEY_CURRENT_USER\\cr2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\\JvaqbjfCbjreFuryy\\i1.0\\CbjreFuryy_VFR.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\StreamResource",
"HKEY_CURRENT_USER\\voxfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_MinMFU",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\StreamResource",
"HKEY_CURRENT_USER\\.divx\\(Default)",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\958C4A0DE6C8D5C428C6E9D875BC33B6\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Stream",
"HKEY_CURRENT_USER\\.mrw\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Pbzchgre Znantrzrag.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\63B1AF366905AF641BA514CCBAE803C4\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\qvfcynlfjvgpu.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallDateFirst",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\(Default)",
"HKEY_CURRENT_USER\\srffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\EEF8AA9EB45B5DB4BBE46B8634C910CD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Security",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemFolderPathDisplay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AIFF\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gz\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.FgvpxlAbgrf",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.ADTS\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\NodeSlots",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\LocalizedName",
"HKEY_CURRENT_USER\\mpeg2file\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.M2TS\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.3G2\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{04731B67-D933-450a-90E6-4ACD2E9408FE}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MOV\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Npprffvovyvgl\\Ba-Fperra Xrlobneq.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\FbhaqErpbeqre.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Npprffvovyvgl\\Fcrrpu Erpbtavgvba.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AIFF\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.3G2\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.VagreargRkcybere.64Ovg",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource",
"HKEY_CURRENT_USER\\exrfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JS.zfp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Pbzzba Svyrf\\Zvpebfbsg Funerq\\Vax\\GnoGvc.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\\Type",
"HKEY_CURRENT_USER\\bz2file\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{15067OP1-P5N8-425R-37P6-SN0O891674S9}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\586A8930D8DF3B6489614C37910BFCF5\\Features\\TclTk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\freivprf.zfp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A7E9995902A24964C9C5D461E1C86F19\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\mkvfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{450D8FBA-AD25-11D0-98A8-0800361B1103}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Nppbhagvat Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\895805CC90C04694887EF6BD140A622D\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{56784854-C6CB-462B-8169-88E350ACB882}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F41A458014D57E54E8DBD0B0CBC361A2\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\NodeSlot",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\18F5DB38C45303843B06B1B5025E4820\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Stream",
"HKEY_CURRENT_USER\\rtffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B06071FE021ECB04E8B3BF1E39AD5BB3\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PreCreate",
"HKEY_CURRENT_USER\\.dss\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
"HKEY_CURRENT_USER\\.nrw\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type 001\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\BE0BD5097A638224EB0DAAE870267F03\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_CURRENT_USER\\.html\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Zrzbel Qvntabfgvpf Gbby.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\84BBAC70FB00B6046881B55CB3122F0F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1F3427C8-5C10-4210-AA03-2EE45287D668}\\InProcServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Fgvpxl Abgrf.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JSF.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Paint.Picture\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\3D197E722531D614AB40C182904D9A31\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F05C8358C56DAD54BB81D0A11DD52F41\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Paint.Picture\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pzq.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\FavoritesRemovedChanges",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Category",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Vaibvpvat Fbsgjner.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Jvaqbjf Nalgvzr Hctenqr.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\ZqFpurq.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\CbjreFuryy_VFR.rkr",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Attributes",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\.mpeg2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\Common Programs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\ZvkCnq ZhygvGenpx Zvkre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.M2TS\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Abgrcnq.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3gp\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.AAC\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\84C584688CFC74A4E9D36E5EE2E02FA7\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Windows.IsoFile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.WAV\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Taskband\\FavoritesChanges",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{9343812e-1c37-4a49-a12e-4b2d810d956b}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Cresbeznapr Zbavgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable",
"HKEY_CURRENT_USER\\.vob\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\53F08364FFD17F14B8FD7CA7F52FAE76\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\EnableSchedule",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.M4A\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\\SortOrderIndex",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3g2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.docx\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PreCreate",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Fbhaq Erpbeqre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Flfgrz Pbasvthengvba.yax",
"HKEY_CURRENT_USER\\7zfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackProgs",
"HKEY_CURRENT_USER\\CABFolder\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8ECC347096FA78C4E8291F449F71E16E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 6",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.M2TS\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\17E23EF6C775D324DB90E0E2B7D1CA72\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.ZrqvnPragre",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MP4\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.IsPinnedToNameSpaceTree",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
"HKEY_CURRENT_USER\\vobfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asf\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\LocalizedName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\\APU Fbsgjner\\Vairagbevn\\vairagbevn.rkr",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\mstsc.exe,-4000",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Crefbany Svanapr Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7BF7ABF4D25C03F4582D4BC3082FB208\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\103857F24A2EDA54A800A41FA570861F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Programs",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LanmanServer\\DefaultSecurity\\SrvsvcDefaultShareInfo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\InitFolderHandler",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{QNN168QR-4306-P8OP-8P11-O596240OQQRQ}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wdp\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CB2182A03B6B11341A1F09A021991CE1\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Name",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Jvaqbjf Zrqvn Cynlre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\NoOplock",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Nppbhagvat Fbsgjner.yax",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\OobeFldr.dll,-33056",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\PropertyHandlers\\.lnk\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Attributes",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{37N86N0O-5OR8-360N-8O0S-91579OQS2ROO}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Category",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zfcnvag.rkr",
"HKEY_CURRENT_USER\\.srw\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp3\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Windows.IsoFile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\LocalizedName",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Zrqvn Pragre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{P804OON7-SN5S-POS7-8O55-2096R5S972PO}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zvtjvm\\cbfgzvt.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pbzrkc.zfp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{Q4N262QQ-PR44-Q105-S36O-9Q77N8PO65N4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\92F9143E715DEF045A539256438E41FB\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\.nef\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\285499F23409ED14FB4A01230F5DFA91\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InitFolderHandler",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.3GP\\shell\\(Default)",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\PromotedIconCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Jvaqbjf Wbheany\\Wbheany.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\StartMenu_Balloon_Time",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\RelativePath",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\SnippingTool.exe,-15051",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Jvaqbjf Snk naq Fpna.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\pngfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F591EF48DE97A00428A5BC1AFFFAA868\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9D22CD4619F5DBC499A083AAD70FE7B3\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.FileName",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\FXSRESM.dll,-114",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Clguba 2.7\\Clguba (pbzznaq yvar).yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_CURRENT_USER\\sr2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\669C9DC1419C0F240B35B36B99AAB50C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gif\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\NeverShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\P:\\Hfref\\Choyvp\\Qrfxgbc\\Vairagbevn Fgbpx Znantre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\2FA90A429E82313489DAA2E2C2F0872C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\cr2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.ASF\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INTERNET_SHELL_FOLDERS\\nchsetup.exe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\CommonPictures",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\tar.gzfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\87C48B95924E3294FBC1766C9225DD0C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\LocalizedName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Clguba 2.7\\Zbqhyr Qbpf.yax",
"HKEY_CURRENT_USER\\.oga\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{58O262P2-RS93-O688-750O-2P8RPQ84452R}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Pbzcbarag Freivprf.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalizedName",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.M4A\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\rtffile\\shell\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\335F6F64CD461D9469519574D34757EB\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FE056816E41FD2F4CACD03E7A2CA2E6E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jrypbzr Pragre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Cache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zfvasb32.rkr",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackProgs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\CLSID\\(Default)",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jvaqbjf CbjreFuryy\\Jvaqbjf CbjreFuryy VFR.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\IconHandler\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{8NOQ94SO-R7Q6-84N6-N997-P918RQQR0NR5}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType",
"HKEY_CURRENT_USER\\dvfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\LocalizedName",
"HKEY_CURRENT_USER\\ds2file\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\docxfile\\shell\\(Default)",
"HKEY_CURRENT_USER\\.crw\\(Default)",
"HKEY_CURRENT_USER\\erffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{618736E0-3C3D-11CF-810C-00AA00389B71}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\StreamResourceType",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_NotifyNewApps",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject",
"HKEY_CURRENT_USER\\giffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MPEG\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7FE547D6F0D72534A80F89C4AB727618\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zvtjvm\\zvtjvm.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\04C56B5D827A9194FA2CBFD014EAD0DA\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4FE19F224928A59468049F045950CB08\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemFolderNameDisplay",
"HKEY_CURRENT_USER\\.jp2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Gnfx Fpurqhyre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\33AB3CD4D27277545B5A93CD4ECB96B4\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Vairagbevn Fgbpx Znantre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\nchsetup.exe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B690B72A999998C47B5F93C94A8D43B2\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\puneznc.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\11E2BA15171FE704B98E7505E58D7749\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\ArgjbexCebwrpgvba.yax",
"HKEY_CURRENT_USER\\gzfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\kcfepuij.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.SFGAOFlags",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{83283PQ6-PO09-7R70-QQN4-Q81112QN721O}",
"HKEY_CURRENT_USER\\dngfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F356843B045CC0A4BA0D83C1D85AAAFD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Icon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Ivqrb Pncgher Fbsgjner.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\rkcybere.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Pbzzba Svyrf\\Zvpebfbsg Funerq\\Vax\\zvc.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
"HKEY_CURRENT_USER\\pngfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Vagrearg Rkcybere (64-ovg).yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D0CBB37A94C46943A90AC5008CF1CC9\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5E3DAE67887931944BCD7171908FA775\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Stream",
"HKEY_CURRENT_USER\\.ogv\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D5FD8239A83FE564F97379EA15CE8CB6\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\flacfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Npprffvovyvgl\\Aneengbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.Kind",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MP3\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\StreamResourceType",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Npprffvovyvgl\\Zntavsl.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\qsethv.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A0256FF64030E0746A4AA95D3FFD0BE4\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemNameDisplay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_CURRENT_USER\\srwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Roamable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MP4\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\62293D511DB84E5489074C5AFA18E882\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wma\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached\\{871C5380-42A0-1069-A2EA-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0xFFFF",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID",
"HKEY_CURRENT_USER\\divxfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{OO044OSQ-25O7-2SNN-22N8-6371N93R0456}",
"HKEY_CURRENT_USER\\.dv\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E116C831A95AB5B4787CE3086FE83631\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FFFA6DF7EA9EDFC45A1F02FE6DF8F067\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9753E3A35E3BDFB468DF95B5D19C8A04\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flap Pragre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5\\TclTk",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\StreamResource",
"HKEY_CURRENT_USER\\srwfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\QIQ Znxre\\QIQZnxre.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\IvqrbCnq Ivqrb Rqvgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0FD387D006FD9734FA65B249F36DE42A\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{53123611-QN37-S8QN-SNP9-03R76QO9Q64Q}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.IconPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\965742E8F65116F4BB2CB01341464FA7\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Stream",
"HKEY_CURRENT_USER\\vocfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\shnfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\gsmfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{e345f35f-9397-435c-8f95-4e922c26259e}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\qvfcynlfjvgpu.rkr",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zfpbasvt.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\Common Startup",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Description",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zboflap.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Category",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\odtfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{11016101-E366-4D22-BC06-4ADA335C892B}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.doc\\(Default)",
"HKEY_CURRENT_USER\\wpdfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\docxfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Gnoyrg CP\\FuncrPbyyrpgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Roamable",
"HKEY_CURRENT_USER\\.caf\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{26EE0668-A00A-44D7-9371-BEB064C98683}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\AD21E12039BB3BC47B1938BC4ABDFEE2\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_LargeMFUIcons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\pngfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.avi\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Cevfz Ivqrb Svyr Sbezng Pbairegre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MOV\\shell\\(Default)",
"HKEY_CURRENT_USER\\.mkv\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\InitFolderHandler",
"HKEY_CURRENT_USER\\.ds2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aif\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Roamable",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Clguba 2.7\\VQYR (Clguba THV).yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Vaibvpvat Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\Common Documents",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\qsethv.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.wma\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\\Image Path",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CDBF699A8F2EAC2438564C3D50E9E638\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\ParsingName",
"HKEY_CURRENT_USER\\rw2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@\"%windir%\\System32\\ie4uinit.exe\",-732",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\rhqprqvg.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.ASF\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Icon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{63365327-N214-QO68-7R0O-636O6NPS87S4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\DocObject",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{8N737966-4Q0N-OR34-73OQ-410009188R91}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\StartMenu_Balloon_Time",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\vfpfvpcy.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseOutOfProcHandlerCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9E40FDB6330EBA242A4BD5F4FDD0B803\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\FolderTypeID",
"HKEY_CURRENT_USER\\dvfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-19\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Flfgrz Vasbezngvba.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Favccvat Gbby.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TIFImage.Document\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseInProcHandlerCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1C1ED53B8F25FD248955C15232E46886\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tgz\\(Default)",
"HKEY_CURRENT_USER\\arwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Sversbk.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zfen.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.au\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\30FAECE2400494D4FB69207288EB5B73\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Ergnvy CBF cbvag bs fnyr fbsgjner flfgrz.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{645FF040-5081-101B-9F08-00AA002F954E}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Fjvgpu Fbhaq Svyr Pbairegre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1F3427C8-5C10-4210-AA03-2EE45287D668}\\InProcServer32\\LoadWithoutCOM",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Jvaqbjf QIQ Znxre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.TTS\\shell\\(Default)",
"HKEY_CURRENT_USER\\odtfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_CURRENT_USER\\caffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\75B368B60C908BA4E87C31F66B02F3F0\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1A0857155A8EF604FA5D1648CF382DC7\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSimpleStartMenu",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\XpsRchVw.exe,-102",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5B5C8B2FB95B57147954C18085D53ACE\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\nrwfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\18D84E9490A485948A17A1F02CDAA62A\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\EnableShareDenyNone",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\InitFolderHandler",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{201P5SO7-0429-89S6-963Q-8QR3N1POO2NR}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionHigh",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Cevag Znantrzrag.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\jpegfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Category"
],
"directory_enumerated": [
"C:\\ProgramData\\NCH Software\\Inventoria\\*.*",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\*.*",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\*.*",
"C:\\Windows\\SysWOW64",
"C:\\Windows\\SysWOW64\\ieframe.dll",
"C:\\Windows\\SysWOW64\\*.*",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\*.*",
"C:\\ProgramData\\NCH Software\\Inventoria\\Logs\\*.*",
"C:\\Windows"
],
"regkey_written": [
"HKEY_CURRENT_USER\\sr2file\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\divxfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\dvfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\nppfile\\(Default)",
"HKEY_CURRENT_USER\\neffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\dvfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\dssfile\\shell\\open\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Service\\StartType",
"HKEY_CURRENT_USER\\apefile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"HKEY_CURRENT_USER\\spjfile\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\VersionMajor",
"HKEY_CURRENT_USER\\deprojfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\caffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\tgafile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.raf\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\exrfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Settings\\InstallerPath",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"HKEY_CURRENT_USER\\vobfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\cdofile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\webpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\arwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\giffile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"HKEY_CURRENT_USER\\7zfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\URLUpdateInfo",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\vpjfile\\(Default)",
"HKEY_CURRENT_USER\\pgffile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\.sr2\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\EstimatedSize",
"HKEY_CURRENT_USER\\vocfile\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\caffile\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\.dng\\(Default)",
"HKEY_CURRENT_USER\\shnfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\tar.gzfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\.pgf\\(Default)",
"HKEY_CURRENT_USER\\odtfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\dctfile\\(Default)",
"HKEY_CURRENT_USER\\tgzfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\pngfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\tgzfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\wpdfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.crw\\(Default)",
"HKEY_CURRENT_USER\\voxfile\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\nppfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\Version",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\NetworkFolder",
"HKEY_CURRENT_USER\\.erf\\(Default)",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\NCHburn\\command\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\erffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.dss\\(Default)",
"HKEY_CURRENT_USER\\.ape\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\rarfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StuckRects2\\Settings",
"HKEY_CURRENT_USER\\.cr2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\DisplayVersion",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\Mode",
"HKEY_CURRENT_USER\\wpsfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\CABFolder\\Shell\\NCHextract\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Scheduler\\SchedBackup",
"HKEY_CURRENT_USER\\srwfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\.vox\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Streams\\Desktop\\TaskbarWinXP",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\rw2file\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\apjfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\srwfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\pngfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupByKey:FMTID",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\NCHconvertsound\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\CurrentVersion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\FFlags",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\tgafile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\arwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\wpsfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\.webp\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"HKEY_CURRENT_USER\\rarfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.wpd\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\rarfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\gzfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\wpdfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"HKEY_CURRENT_USER\\flacfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\caffile\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\webpfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\pngfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\divxfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\rw2file\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\raffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"HKEY_CURRENT_USER\\.rw2\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\shnfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\neffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.tgz\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\NCHconvertsound\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\UninstallString",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupView",
"HKEY_CURRENT_USER\\neffile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\.voc\\(Default)",
"HKEY_CURRENT_USER\\docxfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\gsmfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\DisplayIcon",
"HKEY_CURRENT_USER\\jp2file\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\.shn\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Service\\Installed",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\voxfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\.cdo\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstalledByAdmin",
"HKEY_CURRENT_USER\\dssfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\LanguageList",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"HKEY_CURRENT_USER\\apefile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\srffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\.exr\\(Default)",
"HKEY_CURRENT_USER\\caffile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallerPath",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\GlobalAssocChangedCounter",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallerName",
"HKEY_CURRENT_USER\\.doc\\(Default)",
"HKEY_CURRENT_USER\\arwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\dvfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\giffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.apj\\(Default)",
"HKEY_CURRENT_USER\\rtffile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupByDirection",
"HKEY_CURRENT_USER\\mpdpfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\nppfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\mpeg2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"HKEY_CURRENT_USER\\wpfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\wpfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\voxfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\deprojfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\TIFImage.Document\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"HKEY_CURRENT_USER\\.mrw\\(Default)",
"HKEY_CURRENT_USER\\neffile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\NCHburn\\(Default)",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\IconStreams",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallDateFirst",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\odtfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\NodeSlots",
"HKEY_CURRENT_USER\\cdofile\\(Default)",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\LastAdvertisement",
"HKEY_CURRENT_USER\\ddpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\LogicalViewMode",
"HKEY_CURRENT_USER\\vobfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\VersionMinor",
"HKEY_CURRENT_USER\\tar.gzfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\apjfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\exrfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\.nrw\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\.gz\\(Default)",
"HKEY_CURRENT_USER\\drpfile\\(Default)",
"HKEY_CURRENT_USER\\wpdfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\7zfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.xvid\\(Default)",
"HKEY_CURRENT_USER\\.deproj\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Service\\Enabled",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupByKey:PID",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\apjfile\\(Default)",
"HKEY_CURRENT_USER\\erffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pzq.rkr",
"HKEY_CURRENT_USER\\pgffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\Sort",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\.flac\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\.wps\\(Default)",
"HKEY_CURRENT_USER\\.vob\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\EnableSchedule",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\webpfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\.bz2\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\cdofile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\TIFImage.Document\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\Option",
"HKEY_CURRENT_USER\\tarfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\spjfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\.tga\\(Default)",
"HKEY_CURRENT_USER\\vobfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\gsmfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\docfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"HKEY_CURRENT_USER\\bz2file\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Registration\\NCH\\Inventoria",
"HKEY_CURRENT_USER\\voxfile\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Service\\StartTypeText",
"HKEY_CURRENT_USER\\divxfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\vocfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\divxfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\.divx\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\ddpfile\\(Default)",
"HKEY_CURRENT_USER\\.7z\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\.srw\\(Default)",
"HKEY_CURRENT_USER\\7zfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\.ddp\\(Default)",
"HKEY_CURRENT_USER\\dssfile\\shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.nef\\(Default)",
"HKEY_CURRENT_USER\\tgafile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\dctfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\InventoriaInstall",
"HKEY_CURRENT_USER\\sr2file\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\.mpdp\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\voxfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\pgffile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\tarfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\wpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\vobfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\deprojfile\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\docxfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"HKEY_CURRENT_USER\\docfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\giffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.wp\\(Default)",
"HKEY_CURRENT_USER\\vocfile\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\docfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\neffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallDate",
"HKEY_CURRENT_USER\\tgzfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\dssfile\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"HKEY_CURRENT_USER\\CABFolder\\Shell\\NCHextract\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\InstallLocation",
"HKEY_CURRENT_USER\\dvfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\gzfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\Publisher",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"HKEY_CURRENT_USER\\raffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\mpdpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\URLInfoAbout",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\raffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.jp2\\(Default)",
"HKEY_CURRENT_USER\\vobfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\dssfile\\shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\.spj\\(Default)",
"HKEY_CURRENT_USER\\rtffile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\vocfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\tar.gzfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\vpjfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\apefile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"HKEY_CURRENT_USER\\exrfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.ds2\\(Default)",
"HKEY_CURRENT_USER\\giffile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\NCHconvertimage\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Software\\Installer",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\IconSize",
"HKEY_CURRENT_USER\\crwfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\erffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\drpfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\dctfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\vpjfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\dvfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\.vpj\\(Default)",
"HKEY_CURRENT_USER\\spjfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\.dct\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\srwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\pngfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\divxfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\Folder",
"HKEY_CURRENT_USER\\.dv\\(Default)",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\.mpeg2\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\NCHeditsound\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\MinutesRunSinceLastInstall",
"HKEY_CURRENT_USER\\srwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\shnfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\.drp\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\srwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.npp\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\ColInfo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA",
"HKEY_CURRENT_USER\\dngfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\vocfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache",
"HKEY_CURRENT_USER\\.gsm\\(Default)",
"HKEY_CURRENT_USER\\srffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.caf\\(Default)",
"HKEY_CURRENT_USER\\srffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\gzfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\PastIconsStream",
"HKEY_CURRENT_USER\\rw2file\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\RunsSinceLastInstall",
"HKEY_CURRENT_USER\\.mkv\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"HKEY_CURRENT_USER\\tarfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\ddpfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\mpdpfile\\(Default)",
"HKEY_CURRENT_USER\\wpsfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\drpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\bz2file\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\\APU Fbsgjner\\Vairagbevn\\vairagbevn.rkr",
"HKEY_CURRENT_USER\\sr2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\bz2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\MRUListEx",
"HKEY_CURRENT_USER\\.srf\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\gsmfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\DisplayName",
"HKEY_CURRENT_USER\\.tar.gz\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\caffile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\.arw\\(Default)",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\UserStartTime",
"HKEY_CURRENT_USER\\.tar\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\P:\\Hfref\\phpx\\NccQngn\\Ybpny\\Grzc\\a1f\\apufrghc.rkr",
"HKEY_CURRENT_USER\\.rar\\(Default)"
]
}Dropped
[
{
"yara": [],
"sha1": "233dd36ade6c59269c79f5b2d4429547d8c17796",
"name": "14760c2e35c2e7d6_up.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\up.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "14760c2e35c2e7d63fd64f8d52ddd54d095aeebd0518e9dac7aa160814068397",
"urls": [],
"crc32": "91D8D781",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/14760c2e35c2e7d6_up.gif",
"ssdeep": null,
"size": 257,
"sha512": "561e4072e276440068733e935e0439526301aef0d72d6503c895ae22c1bdff8d798eddcc8546c30222c87394f42e10e6fd2de5571b417e962a67469fd2035e4c",
"pids": [
1676
],
"md5": "3a871992fb83aba86e96b93c2f0b8c59"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "922a725aa6ee9d193c74460d9809bc2f3250b658",
"name": "773859a124021102_wavepad sound editor.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "773859a124021102e5d16e57e2aa01ea522625e4fbfd1fff3f971c5009c99d23",
"urls": [],
"crc32": "20316EEF",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/773859a124021102_wavepad sound editor.lnk",
"ssdeep": null,
"size": 1262,
"sha512": "ab967d35928493254807c10ed91a911444190076a4680ff38bf2c58f26259258717a02a1ee72bcbb8f851119f6286728e2d68a0454c2e761860c3076ce6aaaf9",
"pids": [
1676
],
"md5": "0279f47cfbb5736f45077222c37a0c4e"
},
{
"yara": [],
"sha1": "12995969e7996b4f0fc8ac1526ba7f29647ae4ad",
"name": "396b0baa3fc6b76e_side_image.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\side_image.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 112x269, frames 3",
"sha256": "396b0baa3fc6b76e00bbc7285693952973106db353686b41017715bb6b55b819",
"urls": [],
"crc32": "868DFC83",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/396b0baa3fc6b76e_side_image.jpg",
"ssdeep": null,
"size": 3424,
"sha512": "e170ae7277bbce043f3736be0d25626f67fc71a125f04fc0da44f68a61937d9e3755656dd03395f48d4b63bdae5068fa77ed40669fff04996ca6933e2497c9f6",
"pids": [
1676
],
"md5": "88d8cbd80291c192a3f0ea5867fd6a43"
},
{
"yara": [],
"sha1": "ba214f7be25d613840a39449f86514c8e7c0303f",
"name": "903281541573d6e8_select_arrow.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow.gif",
"type": "GIF image data, version 89a, 15 x 18",
"sha256": "903281541573d6e82c5e46c9c668d7003a0a69c1258cfeb860f994ffcbd17c5b",
"urls": [],
"crc32": "707ABC81",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/903281541573d6e8_select_arrow.gif",
"ssdeep": null,
"size": 636,
"sha512": "4a439868827b65e5925f8e53812b49c00d06b63a8392ae1e3c7fd4543216cbfcc9d3a9f02f3927591c731b3a9f4136f63848f0cb4ddac0b2dc2bf7a844773862",
"pids": [
1676
],
"md5": "e3b6cff8e1bf85288dac539aa15c40cf"
},
{
"yara": [],
"sha1": "d5ebaaec75b03acb67ff999cfa87c72e3d228993",
"name": "bf1f028fc34846bc_combobox.css",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.css",
"type": "ASCII text, with CRLF line terminators",
"sha256": "bf1f028fc34846bc388c3c3a3d912aaa90a3cb7471df6ebf76ee7ddd8305ebaa",
"urls": [],
"crc32": "B7D6713E",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/bf1f028fc34846bc_combobox.css",
"ssdeep": null,
"size": 750,
"sha512": "c5a709e31d6730e9892ebc7313f1c671cd26bacbaec9b59c0907fa584ac58bb80a14e8495c33d282d869236e1ff23e945d80a00d2b52b2e84711221783c77a0a",
"pids": [
1676
],
"md5": "b3b884ea270a16e87bd46c59cf3a8d0e"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "47a4e1886017b7c728bf68c90f371016af2a966b",
"name": "3d8fcd47af322647_nch software download site.lnk",
"filepath": "C:\\Users\\cuck\\Favorites\\NCH Software Download Site.lnk",
"type": "MS Windows shortcut, Item id list present, Has Description string, ctime=Sun Dec 31 22:47:48 1600, mtime=Sun Dec 31 22:47:48 1600, atime=Sun Dec 31 22:47:48 1600, length=0, window=hide",
"sha256": "3d8fcd47af322647f04b30ab816faf188f615a004bb419ec498f39af1858a543",
"urls": [],
"crc32": "F9B75A6F",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/3d8fcd47af322647_nch software download site.lnk",
"ssdeep": null,
"size": 294,
"sha512": "9c3d42a80e4d9439817280a8b4ffdb0230be706affb5ca3633c9079bfa0fc143c0184c41e2c9a1d378c2a8b724dfd9bc684c1af41694a2903f584924463af3a5",
"pids": [
1676
],
"md5": "3bd2b7ee54b7c8c0beebc24bcc2b3ae8"
},
{
"yara": [],
"sha1": "433507434079c308ed8b9dd287795d6ca3832738",
"name": "64599be109f9a7c0_favicon.ico",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\favicon.ico",
"type": "MS Windows icon resource - 5 icons, 32x32",
"sha256": "64599be109f9a7c09af3ff442b5173d6d869d19c748eda98167885e39a153d38",
"urls": [],
"crc32": "DB5C64B5",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/64599be109f9a7c0_favicon.ico",
"ssdeep": null,
"size": 18718,
"sha512": "ed23d580991de4cb054e9971d8a65572f19277c0088c72b665900ff909df9f001d5a1e4efb8e522c8098325fa158fc0fc89c36e851210feffeccfee015b8e0b6",
"pids": [
1676
],
"md5": "52e7eb93f915bd292a9991f7fbe28e6c"
},
{
"yara": [],
"sha1": "9112b3ec1a89869fbb10961a30528916cf54946f",
"name": "48c52cf64beb8cd6_upsort.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\upsort.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "48c52cf64beb8cd6ea4d706c816f7fd1eabd58bd50a42234bcfb231d5ece7211",
"urls": [],
"crc32": "51890B40",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/48c52cf64beb8cd6_upsort.gif",
"ssdeep": null,
"size": 123,
"sha512": "bfe45d39eb24c8c75a70e9d50701197ed619137d706ba3980bccf8c4298c2dd7807b0895734195b551d8e84d56696036c3a969d574f9a055517b365fb70ce444",
"pids": [
1676
],
"md5": "3cde209075bc2133dcf0638c2673de3e"
},
{
"yara": [],
"sha1": "1595d2a77c1551d8e0168c023229774060a83155",
"name": "693237e28799fc79_s.css",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\s.css",
"type": "ASCII text, with CRLF line terminators",
"sha256": "693237e28799fc790372677c5432d37029be8f6be2471dc87df8c8cf01836b80",
"urls": [],
"crc32": "A2D0662E",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/693237e28799fc79_s.css",
"ssdeep": null,
"size": 5800,
"sha512": "82d3830f58f2e149679040671f14127becdb8251a2f952e72e29a4ee27add5d95479ce6541b2abc6534a84e78992b4b1ac4e3555ca8b0b69d4423f0a3e20b94d",
"pids": [
1676
],
"md5": "19b95acb0533e9bb53e374531c62dc4f"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "a3e436a94e0608b9b88e92dd205d87d4a4621b2f",
"name": "23e80270b285cd12_accounting software.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "23e80270b285cd12492edbcde14a1dbe72d5c087609deb1a545837bf3e0b1e56",
"urls": [],
"crc32": "B1B33710",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/23e80270b285cd12_accounting software.lnk",
"ssdeep": null,
"size": 1276,
"sha512": "44331e7abf1281fa93f4fe3f2e5160f916d4b0397e1883fe8483503dad006ee8a6be92f652dcdab36ea73c94157509edff1a4ed54bf4500350e0f66b324069e5",
"pids": [
1676
],
"md5": "a2931783d37f93f9d1d475cdb93c4796"
},
{
"yara": [],
"sha1": "af822c37c7ad4fff6de1a9850d521b48b07a8491",
"name": "5a8cdc1d2f1ab98e_popup.js",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\popup.js",
"type": "ASCII text, with CRLF line terminators",
"sha256": "5a8cdc1d2f1ab98efa387d1b04b2327fb669e2994ca95c2555d53e1bbf755355",
"urls": [],
"crc32": "DBAEA734",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/5a8cdc1d2f1ab98e_popup.js",
"ssdeep": null,
"size": 1582,
"sha512": "6b2d34dc693e6d274e4636737c45c92e5d6e3c83ddc63ea8041eac8aec5948406b3af7853f274372b0d156c954f1ccb2ba8c84446a6ee4974499699f7dfd5283",
"pids": [
1676
],
"md5": "b6059e039e751e40a00c5cdb1ab6ef5f"
},
{
"yara": [],
"sha1": "d96619328c918d0026f1e28cc7e2661a8239dacc",
"name": "7485ffad1eb7f4dd_nchsetup.exe",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"type": "PE32 executable (GUI) Intel 80386, for MS Windows",
"sha256": "7485ffad1eb7f4dd50fffb9fd63779429f24a60444e577c8289722c125f7748a",
"urls": [
"http:\/\/www.entrust.net\/rpa03",
"http:\/\/crl3.digicert.com\/DigiCertHighAssuranceEVRootCA.crl0",
"http:\/\/ts-aia.ws.symantec.com\/tss-ca-g2.cer0",
"http:\/\/cgi.nch.com.au\/cgi-bin\/pingme.exe",
"http:\/\/cgi.nch.com.au\/cgi-bin\/pingme.exe?port=%d",
"http:\/\/crl4.digicert.com\/EVCodeSigningSHA2-g1.crl0K",
"http:\/\/crl.entrust.net\/ts1ca.crl0",
"http:\/\/cacerts.digicert.com\/DigiCertHighAssuranceEVRootCA.crt0",
"http:\/\/crl3.digicert.com\/EVCodeSigningSHA2-g1.crl07",
"http:\/\/cgi.nch.com.au\/cgi-bin\/regcheck.exe?cmd=v",
"http:\/\/www.audiochannel.net\/versions\/components\/%s.txt",
"http:\/\/crl4.digicert.com\/DigiCertHighAssuranceEVRootCA.crl0",
"http:\/\/crl3.digicert.com\/EVCodeSigning-g1.crl03",
"http:\/\/cacerts.digicert.com\/DigiCertEVCodeSigningCA.crt0",
"http:\/\/ns.adobe.com\/xap\/1.0\/mm\/",
"http:\/\/schemas.xmlsoap.org\/soap\/envelope\/",
"http:\/\/www.entrust.net\/rpa0",
"http:\/\/ocsp.digicert.com0C",
"http:\/\/crl.thawte.com\/ThawteTimestampingCA.crl0",
"http:\/\/canberra.nchsoftware.com:120\/minidumpupload",
"http:\/\/crl4.digicert.com\/EVCodeSigning-g1.crl0K",
"http:\/\/ocsp.digicert.com0I",
"http:\/\/ocsp.digicert.com0H",
"http:\/\/ocsp.entrust.net02",
"http:\/\/crl.entrust.net\/2048ca.crl0",
"http:\/\/ocsp.thawte.com0",
"http:\/\/ocsp.entrust.net01",
"http:\/\/ns.adobe.com\/xap\/1.0\/sType\/ResourceRef",
"http:\/\/schemas.xmlsoap.org\/soap\/encoding\/",
"http:\/\/www.nchsoftware.com\/index.html",
"http:\/\/ns.adobe.com\/xap\/1.0\/",
"http:\/\/ts-crl.ws.symantec.com\/tss-ca-g2.crl0(",
"http:\/\/cacerts.digicert.com\/DigiCertEVCodeSigningCA-SHA2.crt0",
"http:\/\/www.audiochannel.net\/versions\/inventoria.txt",
"https:\/\/www.digicert.com\/CPS0",
"http:\/\/www.digicert.com\/ssl-cps-repository.htm0",
"http:\/\/ts-ocsp.ws.symantec.com07"
],
"crc32": "93FDEF84",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/7485ffad1eb7f4dd_nchsetup.exe",
"ssdeep": null,
"size": 1725472,
"sha512": "c92f65f418d97d8588087c06af2707dca4fb127a1b15ebc38027a14e220598ff75eb5695a652d181a8fe8bfa7827b201e56c42aa3af5f81e1c28c2895bb05748",
"pids": [
2660
],
"md5": "fe16bdcf1a4154f204e7a02fe73d84cf"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "f8c27b3f6cec4b806431f0737a7c25b962de1340",
"name": "2aab3c4afe3c5eff_videopad video editor.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "2aab3c4afe3c5eff49a62d3baac2f1cc4d44ae2fb1d721ee5c985e86fda4995b",
"urls": [],
"crc32": "F03404A3",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/2aab3c4afe3c5eff_videopad video editor.lnk",
"ssdeep": null,
"size": 1266,
"sha512": "3c6a2a0bec3d78f22181c304deba7b6965d746fb05a2e77a220cf62521722a5f40f62f7c7ce7effc60f5078be1163d200dbcb6757b79cfaf17b090bb4580333b",
"pids": [
1676
],
"md5": "851978b83c161b50a3790833554e68ed"
},
{
"yara": [],
"sha1": "446188a6a30087c3148363d6b0fc35a78ea6f159",
"name": "5a43814a8338f606_print.css",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\print.css",
"type": "ASCII text, with CRLF line terminators",
"sha256": "5a43814a8338f606612397afa32f97af576d776747667c0abb9e28ea0b822500",
"urls": [],
"crc32": "48CE896A",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/5a43814a8338f606_print.css",
"ssdeep": null,
"size": 1030,
"sha512": "601515ff06b2c55808146b658cb2e4aa99a3fa908b43fd45f9bbc0c9ee1d6566d1026661953994388cc84a37c1794dd20becc27805cc98ae1197a16afa422bf0",
"pids": [
1676
],
"md5": "c852db2b750e5e5ce5d3bc3e93914b67"
},
{
"yara": [],
"sha1": "0b433408c620b1301a522ff2a77fc9e78e1f7f79",
"name": "3b5f8b6085ee2941_options.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\options.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "3b5f8b6085ee29413367f668595d418cb6e43807e5aa3d641d81fca17b0af83a",
"urls": [],
"crc32": "D075D4AC",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/3b5f8b6085ee2941_options.jpg",
"ssdeep": null,
"size": 902,
"sha512": "64e5a5f7bb0e0ddebf395ad51245394dee4b9f31b33ce027bd08cefcfdd641ab282e7e61d4aea734f67c0a0bb58d644b8712fdf08a896d68612db7a8e383f69a",
"pids": [
1676
],
"md5": "f632f26b614050edb05d70f148b57a39"
},
{
"yara": [],
"sha1": "a9c7218a1e31998635f454e2e79b134968be7a06",
"name": "e4e746dd187b64ca_datepicker.js",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datepicker.js",
"type": "HTML document, ASCII text, with very long lines, with CRLF line terminators",
"sha256": "e4e746dd187b64caa0f648524fb3ed8d8abce007f92e8e76709fa6eea693aaf2",
"urls": [
"http:\/\/www.rainforestnet.com"
],
"crc32": "652741A5",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/e4e746dd187b64ca_datepicker.js",
"ssdeep": null,
"size": 8188,
"sha512": "eaec1d34a5bd9c6ad92be0daf25d6ccce1907bd5b920cd403a2de599a8a9811b748d13220751766cdc44335124458042ad7d91af9e8807f5acdd2f5110edcbfb",
"pids": [
1676
],
"md5": "1ab5c6fa712692c44dedc361a5f648eb"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "b9ec89c924e972a0bb130a032772453ec9ed5d88",
"name": "f34a18b32d63895d_prism video file format converter.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "f34a18b32d63895d40741efbb49f3740bdaf27e596b9221316d5e64115e2d2b9",
"urls": [],
"crc32": "5DAA4C6C",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/f34a18b32d63895d_prism video file format converter.lnk",
"ssdeep": null,
"size": 1284,
"sha512": "743a3f88a883ef339d42809bf3249b24f93b9af98f315049c44a2463c81be46028e9298e13e8f2c09f453cf528e63fbf04b0d84271a7faf4fcf6257ce6d0ca88",
"pids": [
1676
],
"md5": "bbb1ec03f50a203d804ab9c91129ea3c"
},
{
"yara": [],
"sha1": "be9355fcc0cdf7e3dd55f6ce6a7fdf8321969782",
"name": "79af81379c38b39a_postfile.js",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\postfile.js",
"type": "ASCII text, with CRLF line terminators",
"sha256": "79af81379c38b39abe19b4e44dd4e19f13cc7d9daa577e92b062e8749b50eae7",
"urls": [],
"crc32": "573268AC",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/79af81379c38b39a_postfile.js",
"ssdeep": null,
"size": 5220,
"sha512": "10dba26773eb373a2e573933b05da51c02a3146ddd02e03751bee9e32da4b9034d56d9864d2fa0ce756595087cf56d6e417966ffaa2bd3004d0f6a44b1937567",
"pids": [
1676
],
"md5": "b7ec9b02601cd77017f4bbf35ca26144"
},
{
"yara": [],
"sha1": "7aa4192641b461916e16fc7701df444f65581aba",
"name": "b65951581ff3b421_cal.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\cal.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "b65951581ff3b4219f3de2544ea69ec30c312dcb1a09b1c1aeadf2db6484dd81",
"urls": [],
"crc32": "0D01AC17",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/b65951581ff3b421_cal.gif",
"ssdeep": null,
"size": 127,
"sha512": "aee9b48e75ee97b4a6b82178a43c5518c8ff80f3dce3aa858220ad9f4154e89c36f5f65e21f5e95e95e3e1fa88cf8f124a7588e9599610f90ac65994e91038e5",
"pids": [
1676
],
"md5": "e05d8b00f8595743d3326c92cd6f2365"
},
{
"yara": [],
"sha1": "50371bac6428cdfee798b5f3ae2738a779156b4a",
"name": "4f307c73cef38295_select_arrow_down.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_down.gif",
"type": "GIF image data, version 89a, 15 x 18",
"sha256": "4f307c73cef382950fd874f96e670fea9f992f8a569ec517e48d8cafd061f8d8",
"urls": [],
"crc32": "6E79611F",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/4f307c73cef38295_select_arrow_down.gif",
"ssdeep": null,
"size": 650,
"sha512": "67f73bc4bdd79b46e42b001ccc5932c8f20e77a2830871418855d57fb9f4151439eb584c5d4ce794d050ac10b9f4ba9bde10935fbe1b80976979b2a230ea30c5",
"pids": [
1676
],
"md5": "ce4d3c824a94b39e70e10ac61c02d75d"
},
{
"yara": [],
"sha1": "cacb7767ceba3c165d6138636ae37616cd1a2797",
"name": "2d2f1b7528f8f111_vl.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\vl.gif",
"type": "GIF image data, version 89a, 10 x 10",
"sha256": "2d2f1b7528f8f111de2696b0947f9034688e8ed51c5bc43087c9e7ac0e549462",
"urls": [],
"crc32": "02F4AE8E",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/2d2f1b7528f8f111_vl.gif",
"ssdeep": null,
"size": 56,
"sha512": "d5028f6e196e5531d7789ca8ff765df9a61c9b1dcf663e46f76601cd10ab03f28885c96c4412d10177577db17a60941097f8fccd6601997ca965f659bb0a3234",
"pids": [
1676
],
"md5": "a74911de76f536faaea5dd4479d3256c"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "484f7c3fe0f4f8835eef6eb0368830ac2d6a370e",
"name": "7b3a18c1ddbd0b74_inventory software.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "7b3a18c1ddbd0b74aa44bea2826bea8ff79facf6e91de9129501b1168b907201",
"urls": [],
"crc32": "5A604E43",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/7b3a18c1ddbd0b74_inventory software.lnk",
"ssdeep": null,
"size": 1200,
"sha512": "7c4ae5eef306e48177631e5c6e4f9eb57b528941cfd239688e625b187263d9e7a305f64099b4ec8b81fb8c1b959baffafb4aa49fa3e89ddbb85a8a889ae3efce",
"pids": [
1676
],
"md5": "b524778ffbf22221b3699e7c087b9c92"
},
{
"yara": [],
"sha1": "b34df1778b26da1c832e6f8088f07adfecf4f303",
"name": "d68a839d2b0e02f7_orders.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\orders.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "d68a839d2b0e02f7e1bf049efc2bfeb0b890413d9d4f0df02fa437f3f4d3bcb2",
"urls": [],
"crc32": "FC44057A",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/d68a839d2b0e02f7_orders.jpg",
"ssdeep": null,
"size": 1245,
"sha512": "acc9479711a2912265f0380cd21307679fbedc565fefb52f05df8344c8b72d8062c2900e07edd9907e5ad0b5441dd7ddaa3fb815b4dd8a99992a1a3e55be690f",
"pids": [
1676
],
"md5": "7faf94865370f0e5674ea6ac9dd32f77"
},
{
"yara": [],
"sha1": "7c7417e7f9130c64f3e8bce40f6e8a648eb8a16f",
"name": "96fc1057060d36e1_nchsetup.cab",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"type": "Microsoft Cabinet archive data, 610657 bytes, 1 file",
"sha256": "96fc1057060d36e164e0a7afc62cb1d67a0aff65301b54a66c1ca709dcfc2d80",
"urls": [],
"crc32": "29AE554B",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/96fc1057060d36e1_nchsetup.cab",
"ssdeep": null,
"size": 610657,
"sha512": "579a50989fb00efa329b828a06ae5795638a3278b3b5a80a457b110d70b4bdc605629d1d1c1d81ddf6ac589922d7ab2935350063e5f55140301b227136b19e6c",
"pids": [
2660
],
"md5": "d23c8eb5c1236ffa03269521ae2676f4"
},
{
"yara": [],
"sha1": "9132bdee5f03e15047cf16fe98712bfadff670eb",
"name": "0f19932e995fba1a_view.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\view.gif",
"type": "GIF image data, version 89a, 16 x 15",
"sha256": "0f19932e995fba1ad69cb336fe98b7fca3405212d225136edf8cbf0a99c502cb",
"urls": [],
"crc32": "FD2F1350",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/0f19932e995fba1a_view.gif",
"ssdeep": null,
"size": 93,
"sha512": "28fc78e7126052239b65fd50ce063c7d0356b463ad32fd14ce8353f234ca3c5f35037baec9f4d59c143d33c2a3addb12c4ddd2348404ae17bf0bca6e9c11cdd7",
"pids": [
1676
],
"md5": "b37630e2bdba1843dcfe3e605d28b4f5"
},
{
"yara": [],
"sha1": "b225cd2d6f9928302ac32c3b70e6994716261009",
"name": "790316fc07aaeb2d_reports.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\reports.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "790316fc07aaeb2ddf76b3a45ef4f883a773466540250599c053d4d727ad9591",
"urls": [],
"crc32": "3845A3D1",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/790316fc07aaeb2d_reports.jpg",
"ssdeep": null,
"size": 1664,
"sha512": "fa16e8ced427b98a383aa5662676b4f9ad5d8bf9530fa383f5e30581c05d76699408ce8553ba905153b8a5eef17cee0fe1c8a96b7819e9bd2b10b0f8eebb201a",
"pids": [
1676
],
"md5": "ed7801f5db71804dc85b08bdcab14ba8"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "0eaac24ba3a4afb580275dd38eca848b30531d65",
"name": "ab7aac2944cc2535_personal finance software.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "ab7aac2944cc2535699b42e93d80e44c60825511a47a07437ed85581b42f0ab3",
"urls": [],
"crc32": "A032DD88",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/ab7aac2944cc2535_personal finance software.lnk",
"ssdeep": null,
"size": 1276,
"sha512": "233052676bf2a406561ac270a409a6083618a2b866ad4ea66b35df809c6895104cd470d00f4471fbdd835034c0e29d6e80cccc4d82f874ed3856b5dc11d2a9db",
"pids": [
1676
],
"md5": "36cceec7cdd9195ebdd048e584f087e0"
},
{
"yara": [],
"sha1": "d8783dbf50929640b31f62dddf893905e6fd613f",
"name": "b492bae7199d6fd2_greybg.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\greybg.gif",
"type": "GIF image data, version 89a, 1 x 74",
"sha256": "b492bae7199d6fd28acfa513804eb0a8b63ae24d5f46451fc4b50b2390d6a72c",
"urls": [],
"crc32": "94735B44",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/b492bae7199d6fd2_greybg.gif",
"ssdeep": null,
"size": 275,
"sha512": "cfd770896eb9f37940a70219f5bc333f56e9f05a1472dda7bee509daf95b5bc2e0eef676218f3eb55846cb1766aee9b0da9b76bc69ca6de14984f278a0698bc7",
"pids": [
1676
],
"md5": "d858ad06357e03d9bba96eb846aef914"
},
{
"yara": [],
"sha1": "b193d91e60458683256554fde0e2482ab41b0b60",
"name": "6b07cc66e908ae33_customers.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\customers.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "6b07cc66e908ae3398332c8f7f8eeaa704a8ca31bc1abe457905e1d3aececc6f",
"urls": [],
"crc32": "0B016045",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/6b07cc66e908ae33_customers.jpg",
"ssdeep": null,
"size": 1652,
"sha512": "a740636a07b9a3754d876208b243385a4e069a92406ede37d64804179737a67172e562426702c4788a64dd8df069a0dec9dbf1771c87de56b6d713623d48a760",
"pids": [
1676
],
"md5": "e5f1dfcf94be609752cfa48167410115"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "58b74cdd01da8ccc7526d1dad6bedc4cf20f203c",
"name": "590cdf132b14e93c_express burn cd, dvd or blu-ray.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "590cdf132b14e93c78939ffa06b4050289f8b291203340f039fcf0416e1948b8",
"urls": [],
"crc32": "54E5CA85",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/590cdf132b14e93c_express burn cd, dvd or blu-ray.lnk",
"ssdeep": null,
"size": 1292,
"sha512": "44005d77539fc2e2c7b447597e614632ddd25783b99ef6a84d8b958f946712fcbb623fa07d6904f67e5bd93b7778e78f592b1277a746a08bcee1e8e6a93e3cf7",
"pids": [
1676
],
"md5": "4ad27b18699c772e80c7a23e90decf6d"
},
{
"yara": [],
"sha1": "a1463dedc6b5e62152698c86229582b9e9ab1ce7",
"name": "d9859bcebb152ab9_schedule.bmp",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\schedule.bmp",
"type": "PC bitmap, Windows 3.x format, 24 x 24 x 8",
"sha256": "d9859bcebb152ab99f6f9937f138d9a6b6cdc3f91c459210f854b9af8e3d5deb",
"urls": [],
"crc32": "B88F37C7",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/d9859bcebb152ab9_schedule.bmp",
"ssdeep": null,
"size": 1656,
"sha512": "6dafdd5152b5cddaeee6d88ba10e19f0cee1bbf2845fb54aae94cfb56e4d7fe94c24817525499138c4b4dfae63a394add42dcb0c5705d309b34353d4a6c7f8fd",
"pids": [
1676
],
"md5": "3da9f6bc1a897580cd345d6ef6f190d6"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "0ceaf7c2742a25e00aabb91735a8da8108faf6ea",
"name": "204afc0564641ba5_inventoria stock manager.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "204afc0564641ba5845ee9e7c3b22ce2e7701f5f2e66c75427636cc52fa304ce",
"urls": [],
"crc32": "FBE43D54",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/204afc0564641ba5_inventoria stock manager.lnk",
"ssdeep": null,
"size": 1172,
"sha512": "316a16cb1c7051da5873d85bd4a5ede43706b1558374d017366fbdd2a411f714a60e8863b8b6e6dbfcf334753890b7c7bdb200e564116878daeb9b8ad0703741",
"pids": [
1676
],
"md5": "4eafdf9db00e6eeec1e6156f9447a449"
},
{
"yara": [],
"sha1": "125014c8aa3b35c5d7a01651401fbc963b4a5a64",
"name": "aa6786b9488c6f45_users.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\users.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "aa6786b9488c6f45bc254ae8cf20341664b5f5ebbad3b648688d57fabff19b34",
"urls": [],
"crc32": "470EC942",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/aa6786b9488c6f45_users.jpg",
"ssdeep": null,
"size": 1241,
"sha512": "8bbebaf8a7890ee2e786d0c3d94a142e0be1bd09770ae68ab263b42092f987e51f7b4b13683d975b40a771125f7509f1b8d68a4cc0f7ea28c1dec00f61f461bd",
"pids": [
1676
],
"md5": "4b36bfacccffb9dd57d3f23ba06f0791"
},
{
"yara": [],
"sha1": "ddf805198d4cae35fa2ebd7b5d5bd2fd24f03107",
"name": "915216df2cbdf029_purchase.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\purchase.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "915216df2cbdf029f0612d94b9433d937a1026d68d07eea2baf0fe2357f94b50",
"urls": [],
"crc32": "8459CF6D",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/915216df2cbdf029_purchase.gif",
"ssdeep": null,
"size": 625,
"sha512": "9b99e499607cb1e9f8854c21bc9f662ea310409c34d5dc3f1276a06aafac1e1b9bce815f70174c2adac761db6e370347a09f35c7762105c15c1632a833f627c1",
"pids": [
1676
],
"md5": "b3b10b1a07412da3f4cbd964564f8b8c"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "8309f387dc4ccc7063915e6da3330f0dda680eab",
"name": "ba404109eaba8838_nch suite.lnk",
"filepath": "C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=-910, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "ba404109eaba883809ec0519fcec82dff0f917b05b62458d1e9f64ffd8e565e2",
"urls": [],
"crc32": "E8AD9776",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/ba404109eaba8838_nch suite.lnk",
"ssdeep": null,
"size": 1314,
"sha512": "3e5e964703655814325ab86bf8572cbaee9b5df29e2ada96a4608b10e60b9e973daf36ff38af13fca79f18a9dc68bd7109fd75cba074dd55f3a50f7d8b9790fa",
"pids": [
1676
],
"md5": "2a4e470e8cb0da920c9ac1204cb9981e"
},
{
"yara": [],
"sha1": "431018cd68e58608892cc2a46aa1cdbd3a31459b",
"name": "7436aca2f7bdb8c3_trash.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\trash.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "7436aca2f7bdb8c3ae9ff942e845464e129784b9b6190d4ccf30d28336d7b2f4",
"urls": [],
"crc32": "430CCFA7",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/7436aca2f7bdb8c3_trash.gif",
"ssdeep": null,
"size": 872,
"sha512": "5c1ec8b4fa59b4f8283a8d0073d59e3018f73e283abc26b3f3908018a095d9ea137c05d94ff87cc1fbf83ae2e11f5db83ce1d9501be760587d93ccb1ccdd36a1",
"pids": [
1676
],
"md5": "31ab492cef2e55c1f714fcd1d860324f"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "12bf81e9ec63b8a406ade3f69e82e43d004d3793",
"name": "fd82574be2ae12c9_video capture software.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "fd82574be2ae12c9d61fcd3f32ce25e5aca6b807a6a9f56e1a0a14aab817b7f3",
"urls": [],
"crc32": "589B16C0",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/fd82574be2ae12c9_video capture software.lnk",
"ssdeep": null,
"size": 1262,
"sha512": "490bc0ba0f4bbd2787188ed5fef167925d2f3e5f99c7e59163e2f2a04a2b8cdf235b7a192dbc77a431f90f8c309e120ea52302e6d8b2088ef4a0205919edd4ea",
"pids": [
1676
],
"md5": "9c62dd334ca7cee1b4bfbd44848ecc4f"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "863269da7d722358d49aa63cedd46f1ca8e8c239",
"name": "fad619534ff309e8_switch sound file converter.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "fad619534ff309e89c6a83abf1d2ff96834f200a4a43d5b243dd5d1e66216211",
"urls": [],
"crc32": "48D6243B",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/fad619534ff309e8_switch sound file converter.lnk",
"ssdeep": null,
"size": 1274,
"sha512": "82d416c6e0e31f63a3b7642567fa457d2f679f4f037d2884ee5e318e2d248cf07281a5b37b512a354ec5554c3d94cfe7c47c4a3735c16261f21af63e548fd8dd",
"pids": [
1676
],
"md5": "c941f26aa877f1b67835216245e0f53f"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "31ea321954a01966b4e7b0d2f9319bc4536737f1",
"name": "b0acb56230debf2c_transcription software.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "b0acb56230debf2c6d48cc8807d49bce3202569a52f4f3d6d915cde9a20bc37a",
"urls": [],
"crc32": "EC3200E8",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/b0acb56230debf2c_transcription software.lnk",
"ssdeep": null,
"size": 1264,
"sha512": "bca10c56f8e5eaba9378b2deaea8317f3a65826d318bf1241428132dfec2e82cc8e05d80f97ad55e22fb049e348da194577a933d272cad6fff9b4743b5965096",
"pids": [
1676
],
"md5": "43a6dcfb4825bec053adec234f6b68ea"
},
{
"yara": [],
"sha1": "4ffd058d4778cf4e99701799b8309b18487d0292",
"name": "09cd66e0eef7ea5f_combobox.js",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.js",
"type": "ASCII text, with CRLF line terminators",
"sha256": "09cd66e0eef7ea5f94e3e1e9120f50bf4b05a5ea1313369579ebbd5a16fc118e",
"urls": [],
"crc32": "7668FC5D",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/09cd66e0eef7ea5f_combobox.js",
"ssdeep": null,
"size": 5489,
"sha512": "f1b08ba7ebe91afd6fb279bb3633ce1438254e183da96db7d9edcaba77f4627bd592b7efdfed1207b353e2d632380005120fd1933ef9da52828a864b877eca8c",
"pids": [
1676
],
"md5": "ea91432967a29cfa77c3d7712e178024"
},
{
"yara": [],
"sha1": "2123431ad19b1f48c8522d3b789b6c77b422d264",
"name": "c17b0b5a96aa62cd_transfer.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\transfer.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "c17b0b5a96aa62cdc1503d958e18157493280fe9b83ca5b6c851e31c56a78525",
"urls": [],
"crc32": "1C46AE2A",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/c17b0b5a96aa62cd_transfer.gif",
"ssdeep": null,
"size": 559,
"sha512": "29d149a84d543e86209bff7c2eb3f092d29113c94148b56074b129e0fa071642a1c8b8f79fb62ce66df2c1f1feebca634410a1eb90e681b1a03b674a6a16b6c0",
"pids": [
1676
],
"md5": "29dd86b4001b62e5a828354c6bb74f58"
},
{
"yara": [],
"sha1": "dd399e9213c2663583e113131ff3f2e38b096f3b",
"name": "5e5245612e70c16d_sell.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\sell.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "5e5245612e70c16d57751e7dade3010970d4f0eb13fb706868946250e525759a",
"urls": [],
"crc32": "7DBD0228",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/5e5245612e70c16d_sell.gif",
"ssdeep": null,
"size": 349,
"sha512": "3826e9722ee16b6a0a9f6a42d1da63f05fefd777da1948b2575be4d05f9ebaaa21c48d4ad6d69d468c02ed477e115fa35b478b0c2857c2a017c268aedde10fd6",
"pids": [
1676
],
"md5": "e5faab693e09c34d4967843f780f8c36"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "056cc6b7437f16c122953e829dee568d7f5cd2d5",
"name": "b0f675ce3e2b6ec9_retail pos point of sale software system.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "b0f675ce3e2b6ec9fc82d992cb47f6438f11f5f7aa0074e597bdfdc43e3474b4",
"urls": [],
"crc32": "F2BD56F2",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/b0f675ce3e2b6ec9_retail pos point of sale software system.lnk",
"ssdeep": null,
"size": 1300,
"sha512": "0da9fd7ca9638d40ce6ba84b36ebfb929a22d263d593fc1f86b998e77ee11ddcf02ba870c60f38ead64f8b339d3975268b755d7bb5ca00ee7e2aee36e097b7ed",
"pids": [
1676
],
"md5": "831cffb815bbe83546f00c270472f7dd"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "8ecb85bff527176c069f33bc27717ed391addad7",
"name": "ac677c7da76ea2a2_mixpad multitrack mixer.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "ac677c7da76ea2a225e95e9be49d4d2c2b751308b608d30603ff73ae90838d4c",
"urls": [],
"crc32": "75F78097",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/ac677c7da76ea2a2_mixpad multitrack mixer.lnk",
"ssdeep": null,
"size": 1266,
"sha512": "8b74a0f76153cd9aee9f756dba585395ef32c22465c556f85b7e2c334488b2859eddafca3da883e46aceacb690017530c852b7449f928eacb8d5e751db79c692",
"pids": [
1676
],
"md5": "ddcc5fbbc329388ea72a76cbdf594f7e"
},
{
"yara": [],
"sha1": "9baa98f17313a786b689306f8d41c2035304a4bf",
"name": "32c751ef17a0faeb_select_arrow_over.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_over.gif",
"type": "GIF image data, version 89a, 15 x 18",
"sha256": "32c751ef17a0faebf3ffb558e92044823e67c725eadcd00d802813bf6797cd2d",
"urls": [],
"crc32": "BA49BBD4",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/32c751ef17a0faeb_select_arrow_over.gif",
"ssdeep": null,
"size": 639,
"sha512": "4de4f83f08402c92d4f136f8fc667d6401532bdedd609c1f2d3287e3132c29c5c4e38a9c856baf31ed73ecc858d0c971efa7e271774fc3695da191ea18c9ee31",
"pids": [
1676
],
"md5": "2b9f09864524f10e2606bec2c7f26a10"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "c0d398e74cd1548778ad370095e91ebc31150da7",
"name": "d1fb904fab072998_inventoria stock manager.lnk",
"filepath": "C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "d1fb904fab0729980e2240d74e22d3bbb844b17477e3d1730daccf055b4634d5",
"urls": [],
"crc32": "7C75BB27",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/d1fb904fab072998_inventoria stock manager.lnk",
"ssdeep": null,
"size": 1160,
"sha512": "b2bd0a06dc4638e1dbe81255cc937ad12af68d70c4626dd6ccf10db6ef11818941dace0b8ad88ee390bcdbf71fb7967ba9a298070304e199fcd549880c32a8c4",
"pids": [
1676
],
"md5": "1f24c260970865ac6b525573212bfe73"
},
{
"yara": [],
"sha1": "21f5641772bc84d2826dd7796011410217273b49",
"name": "7430c6a69c5229df_downsort.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\downsort.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "7430c6a69c5229dfdb74f61927af9920ec075d653782b0129680b7f37a448e54",
"urls": [],
"crc32": "967EED3C",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/7430c6a69c5229df_downsort.gif",
"ssdeep": null,
"size": 123,
"sha512": "941822a71e3695d700b82ad1d3d962361d62dfec3b2ff7e976e7a1039414f07524574f349c5fcb0e830dedf586630eac48215a4048d4ce29df15ae027460d083",
"pids": [
1676
],
"md5": "797e557c17e9d17b315ca1a2a68295ec"
},
{
"yara": [],
"sha1": "1ad4806274171ecfa6ac5e3674cfeae9d3ffb5eb",
"name": "7c6fd1c371f71efe_nchdata.dat",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat",
"type": "data",
"sha256": "7c6fd1c371f71efe8e7df3368d6c56aeb536aefdc4a5e8574ed71a64c44ff88b",
"urls": [
"http:\/\/www.rainforestnet.com"
],
"crc32": "32A1FF51",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/7c6fd1c371f71efe_nchdata.dat",
"ssdeep": null,
"size": 84654,
"sha512": "fe7474798670396d95402e1c7796b0372d52739073073991fba8588638613090725d477c221b5244b2eecf367331d906f0443fa4e1bca2a8c4ef497570ac4717",
"pids": [
2660
],
"md5": "5ca4411a75a20d16bfc179f794580291"
},
{
"yara": [],
"sha1": "968be790936192a4bdc06e076fc1895ae8cabea1",
"name": "ad8b543d2ff38936_table.js",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\table.js",
"type": "ASCII text, with CRLF line terminators",
"sha256": "ad8b543d2ff38936cf148ba5ac8035f682c7419fbf6c9dc46fa1c1284050984f",
"urls": [],
"crc32": "9E694BF9",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/ad8b543d2ff38936_table.js",
"ssdeep": null,
"size": 8437,
"sha512": "6ea18a1f5acb429e0450a5f6a47ff117cd710e83ba7871f5c7bfdb66fea4d2e639de823b612e1367c2dae08c589461d0a24f477f4cb27e4885b4e480eaa8af7d",
"pids": [
1676
],
"md5": "401d6b7bbd03a15fd96a24214d884bf7"
},
{
"yara": [
{
"meta": {
"description": "(no description)"
},
"name": "LnkHeader",
"offsets": {
"guid": [
[
4,
0
]
],
"signature": [
[
0,
1
]
]
},
"strings": [
"ARQCAAAAAADAAAAAAAAARg==",
"TAAAAA=="
]
}
],
"sha1": "af9dd3e0a5f9a9647ed93e5fb5accf1c5bbf9492",
"name": "87341d23e25b780f_invoicing software.lnk",
"filepath": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"type": "MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=19, Archive, ctime=Sat May 9 19:53:08 2020, mtime=Sat May 9 19:53:08 2020, atime=Thu Oct 18 05:03:00 2018, length=1725472, window=hide",
"sha256": "87341d23e25b780f7ad53a4c6ec78976c628a856bcb6ca3b7c7809d9ec29faae",
"urls": [],
"crc32": "0BA56402",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/87341d23e25b780f_invoicing software.lnk",
"ssdeep": null,
"size": 1272,
"sha512": "1cab5dc40ccf93cd20dd0ab0d69c1f920bf4774b82c7eb3bbab1b7f732d05a87a7f9fe9e7409eb29d7a8e902277fee1d9ab0ac3d6296426986e1ecbab26b4aee",
"pids": [
1676
],
"md5": "eff0039648e32a0f66efeced8d7792b7"
},
{
"yara": [],
"sha1": "27ecac9c3aa218a3dabe44f29bd495215f0a1731",
"name": "7ecfbc875e41d4a0_suppliers.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\suppliers.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "7ecfbc875e41d4a02803fe5b6998ec7ff3cf8f7a694383bf6206ca89c5e9afb8",
"urls": [],
"crc32": "DB59A48A",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/7ecfbc875e41d4a0_suppliers.jpg",
"ssdeep": null,
"size": 1610,
"sha512": "bfa6def7e5ae2a3dfb53580cd8758308e2dc4a2ea7445e519421bebfe232d15d5874581f276d471acdd77ce9652308c0eb0f4525c82bc4601717b9af7a92e502",
"pids": [
1676
],
"md5": "e8a1cd74dbf3f22bdcc679a06786f695"
},
{
"yara": [],
"sha1": "10532f9c981159c047d3692b6dd5ca8772648ddc",
"name": "0f98dbc2b928ec6a_darkblue.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\darkblue.gif",
"type": "GIF image data, version 89a, 1 x 44",
"sha256": "0f98dbc2b928ec6a6a43d31d43b86b8939e5d0daee589290f303d2be7231a84d",
"urls": [],
"crc32": "880CD60D",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/0f98dbc2b928ec6a_darkblue.gif",
"ssdeep": null,
"size": 257,
"sha512": "0b4cb40f823c97b86c49f64d72e1a064eb06c2ef458a830f14040aa533cfdfd0a26e40bbe194b183978d80025e5d31f292e07c4302123fa6d377641db2b10e41",
"pids": [
1676
],
"md5": "5ed4de65386c03538367a5375b19ff1c"
},
{
"yara": [],
"sha1": "0c135bbebb84a7c63eccf1f9bc066f0a0f1f1509",
"name": "8c7339b896c5c5c7_locations.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\locations.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "8c7339b896c5c5c74a6100f3eccf19cd4c9a3f3355c8de3ea36afe173623aa36",
"urls": [],
"crc32": "8A820C3A",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/8c7339b896c5c5c7_locations.jpg",
"ssdeep": null,
"size": 2015,
"sha512": "97ac2d7d5febbaa7353b0afa50de57c777650535050ee878c22c2a87246247b07afe9b73c2febd3dee30318ad664e77fc04f318042e0dcd0d28bce280e016995",
"pids": [
1676
],
"md5": "222cc1d200d95fd0ef0c64df523ab9a9"
},
{
"yara": [],
"sha1": "59fb64781d84627ab0652fbb052704d7eaaf2697",
"name": "7a5495b90eec7234_items.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\items.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "7a5495b90eec7234b6433b97439bdecc5c522fbf9663099425f0f9deeba88588",
"urls": [],
"crc32": "ADC6F38C",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/7a5495b90eec7234_items.jpg",
"ssdeep": null,
"size": 1667,
"sha512": "34189f10c65addaa70a819c0c69efb8272c008a582822ffeff3d8e3232426d63c1568228726a604e721636e5560305521db9ed2055118ca3b4dff5da20b31b7b",
"pids": [
1676
],
"md5": "716245c0a4f4b17e2ea2e227c57a01da"
},
{
"yara": [],
"sha1": "13c10c2b57ca368f989cad5d91b644106c6bfed3",
"name": "c3dae6e54d488115_nchdata.cab",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"type": "Microsoft Cabinet archive data, 38389 bytes, 1 file",
"sha256": "c3dae6e54d488115533531efbf4c38d9577d3f82ff6b7f5e5e8c40ed5789a479",
"urls": [],
"crc32": "7FFEE31C",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/c3dae6e54d488115_nchdata.cab",
"ssdeep": null,
"size": 38389,
"sha512": "1d76b61772fb797d37c090c87bf2374a720b2816bc0655b4b1ad61b47d496edb9317afacf929040c1ec5a307d301038b052a44d3d6cfd88a2d6fcf1cb4f10871",
"pids": [
2660
],
"md5": "7b578b58516cb01986d820238de5c773"
},
{
"yara": [],
"sha1": "ea644201baa7460ce8d6560c0263f9ef5e15a2b3",
"name": "88eb9d601e08a8e0_datetime.js",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datetime.js",
"type": "ASCII text, with CRLF line terminators",
"sha256": "88eb9d601e08a8e054c6e59b4722d627f4ddb20f15b97993cdd4472d25ee1262",
"urls": [],
"crc32": "3BADC529",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/88eb9d601e08a8e0_datetime.js",
"ssdeep": null,
"size": 1114,
"sha512": "334b08e065e4dcbea18813c33f731783ee41e73085026153a653630e1221fcff6ef30be145b4c178b3de32c7295b1da3c8804d0f01709650495ad2926cdd6790",
"pids": [
1676
],
"md5": "736db7fdcfbd2171cd779c0a6d90e786"
},
{
"yara": [],
"sha1": "1c146f49d6eb92e5a6534a4c0434c28ba1c0e28a",
"name": "74b359857716b609_down.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\down.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "74b359857716b609ec78aee32f1313fb9073c63269fd318d65648af35f72d330",
"urls": [],
"crc32": "FDF5BE41",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/74b359857716b609_down.gif",
"ssdeep": null,
"size": 255,
"sha512": "c5ed0d566097198db034cf40c6942be6efe32ade2ca14b2a79376a3f257acf3744cd0d703381b8be9324d8ea0f75906dd86fbbe3f67e32552e9674e7dfb5afc7",
"pids": [
1676
],
"md5": "eee35fdece0d09df8b5c8eef51973902"
},
{
"yara": [],
"sha1": "cb6ab7911afaef14cdcd48c683260be27293bbb8",
"name": "22347c958792f462_arrow_blue.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\arrow_blue.gif",
"type": "GIF image data, version 89a, 31 x 12",
"sha256": "22347c958792f46206948298525dcfd79e290cae19033f86fbc55d832900ab1a",
"urls": [],
"crc32": "38894383",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/22347c958792f462_arrow_blue.gif",
"ssdeep": null,
"size": 202,
"sha512": "80968929bb6f80d1598afca0154c45c27306baeab8f4bccf422542d2cab486850c604df200d238563cfaa92551d142383e7448ff7305051957257b806f20d9cb",
"pids": [
1676
],
"md5": "9ccffbae612507d2408476c08e1697a9"
},
{
"yara": [],
"sha1": "c408a156c5157a837c895627d2f7fb461cfcea4c",
"name": "eaff25a80854f428_categories.jpg",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\categories.jpg",
"type": "JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 48x48, frames 3",
"sha256": "eaff25a80854f428f65463ca9d1497dff6f29637c08e31aee4e6de82c9d552bf",
"urls": [],
"crc32": "CD211347",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/eaff25a80854f428_categories.jpg",
"ssdeep": null,
"size": 2079,
"sha512": "78691ceb0371bebecbd9dbfcc6eec2e83de2a156b3745126b89f46a72e3e4929886a5f27f479a64374cc5eedf6832484dae43ea9324a9fa98ec8a6b6b40a1b97",
"pids": [
1676
],
"md5": "d233f45a4d6c7d099be64d7e00be5711"
},
{
"yara": [],
"sha1": "48df851bcdf2b5c61dd0d2395f58799fedde689b",
"name": "85a692486790e24c_ajax.js",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\ajax.js",
"type": "ASCII text, with CRLF line terminators",
"sha256": "85a692486790e24c602b7ea403b7c5019a3345cc5bbd9d1fd20339b4ee7aa3ce",
"urls": [],
"crc32": "E9076363",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/85a692486790e24c_ajax.js",
"ssdeep": null,
"size": 2705,
"sha512": "c341487fc41eb1c6722bf4f147b6238e24fc0e4dc7abcf5ae5c77a0d893ce4919df5ec747601f46aa8fcd566dc3556db5d6790ac64b027f41d00fec970e04b0a",
"pids": [
1676
],
"md5": "190d8c042888cf95e9e64c92413cc31b"
},
{
"yara": [],
"sha1": "a58241ee96ac0995f5b6c45a2b94df5d29d2328b",
"name": "c3d1aa58def2b052_edit.gif",
"filepath": "C:\\ProgramData\\NCH Software\\Inventoria\\Web\\edit.gif",
"type": "GIF image data, version 89a, 16 x 16",
"sha256": "c3d1aa58def2b052a6ab8e86c591f67347968db50789ba8dadfccdf4881b07d6",
"urls": [],
"crc32": "9DFD916C",
"path": "\/home\/hpuser\/.cuckoo\/storage\/analyses\/7437\/files\/c3d1aa58def2b052_edit.gif",
"ssdeep": null,
"size": 204,
"sha512": "f5b60022a6888404675025279f4d45ee9915e29a29dcded6b77538e784f590600faa7c0e885bdb42a5ccd135282158bd98dde2f1131c5e7d258dc1916d7c5c7a",
"pids": [
1676
],
"md5": "411cb331e80e0b38986b39694ef32e63"
}
]Generic
[
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin",
"process_name": "c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin",
"pid": 2660,
"summary": {
"file_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat"
],
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s"
],
"dll_loaded": [
"kernel32.dll",
"SETUPAPI.dll",
"Cabinet.dll",
"DEVRTL.dll"
],
"file_failed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe"
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_LOCAL_MACHINE\\System\\Setup"
],
"file_written": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat"
],
"file_deleted": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat"
],
"directory_removed": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s"
],
"file_exists": [
"C:\\Windows\\inf\\"
],
"file_opened": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
],
"command_line": [
"\"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe\" -installer \"C:\\Users\\cuck\\AppData\\Local\\Temp\\c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin\" -instdata \"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat\"",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe -installer \"C:\\Users\\cuck\\AppData\\Local\\Temp\\c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin\" -instdata \"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat\""
],
"file_read": [
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.cab",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.cab"
],
"regkey_read": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogLevel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMaxFileSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\LogMask"
]
},
"first_seen": 1589064786.515625,
"ppid": 3040
},
{
"process_path": "C:\\Windows\\System32\\lsass.exe",
"process_name": "lsass.exe",
"pid": 476,
"summary": {},
"first_seen": 1589064786.328125,
"ppid": 376
},
{
"process_path": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"process_name": "nchsetup.exe",
"pid": 1676,
"summary": {
"file_created": [
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\options.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\print.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\favicon.ico",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\downsort.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\vl.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\categories.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\edit.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datepicker.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\side_image.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\items.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\table.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_over.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\greybg.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\ajax.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\down.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\purchase.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\suppliers.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\orders.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\reports.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_down.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\upsort.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\users.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\s.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\postfile.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\schedule.bmp",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\locations.jpg",
"C:\\Users\\cuck\\Favorites\\NCH Software Download Site.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\view.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\trash.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\darkblue.gif",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\cal.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\customers.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\arrow_blue.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\transfer.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\popup.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\sell.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\up.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datetime.js"
],
"directory_created": [
"C:\\ProgramData\\NCH Software\\Inventoria",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\testfolder",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web",
"C:\\Program Files (x86)\\NCH Software",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc",
"C:\\Users\\cuck\\AppData\\Roaming\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\AppData\\Roaming\\NCH Software\\Inventoria\\Backup",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\AppData\\Roaming\\NCH Software",
"C:\\ProgramData\\NCH Software\\Inventoria\\Logs",
"C:\\ProgramData\\NCH Software"
],
"dll_loaded": [
"urlmon.dll",
"API-MS-Win-Security-LSALookup-L1-1-0.dll",
"srvcli.dll",
"apphelp.dll",
"LINKINFO.dll",
"Advapi32.dll",
"C:\\Windows\\system32\\DUser.dll",
"UxTheme.dll",
"C:\\Windows\\system32\\ole32.dll",
"dwmapi.dll",
"ntdll.dll",
"C:\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\\gdiplus.dll",
"slc.dll",
"ntmarta.dll",
"PROPSYS.dll",
"C:\\Windows\\syswow64\\MSCTF.dll",
"API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
"OLEAUT32.DLL",
"SspiCli.dll",
"comctl32",
"ole32.dll",
"SHLWAPI.dll",
"USER32.dll",
"IMM32.dll",
"API-MS-Win-Security-SDDL-L1-1-0.dll",
"XmlLite.dll",
"C:\\Windows\\system32\\xmllite.dll",
"OLEAUT32.dll",
"netutils.dll",
"SHELL32.dll",
"User32.dll",
"comctl32.dll",
"DUser.dll",
"VERSION.dll",
"kernel32.dll",
"ADVAPI32.dll",
"SETUPAPI.dll",
"ntshrui.dll",
"user32.dll",
"OLEACC.dll"
],
"file_opened": [
"C:\\Windows\\System32\\oleaccrc.dll",
"C:\\Windows\\SysWOW64\\ieframe.dll",
"C:\\",
"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe",
"C:\\Windows\\SysWOW64\\",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000004.db",
"C:\\ProgramData\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"C:\\Program Files (x86)\\NCH Software",
"C:\\Program Files (x86)",
"C:\\Users\\cuck\\Desktop\\desktop.ini",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web",
"C:\\ProgramData\\NCH Software\\Inventoria\\Logs",
"C:\\Program Files (x86)\\desktop.ini",
"C:\\ProgramData\\NCH Software",
"C:\\Windows\\AppPatch\\sysmain.sdb"
],
"file_copied": [
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoriasetup_v4.03.exe"
],
[
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe"
]
],
"regkey_opened": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.xvid\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.flac",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\ExpressPoints",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.mkv\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mkvfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.mpeg",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\Shell\\Convert file type",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M4A\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\ExpressBurn",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\NCHeditvideo\\command",
"HKEY_CLASSES_ROOT\\.dss",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.exr",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\SuiteUsage",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.cdo",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.npp\\userchoice",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.gsm\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.apj",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\DrawPad",
"HKEY_CURRENT_USER\\Software\\Classes\\wdpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.ape",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.rar\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.mpeg2\\userchoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mpeg2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\bz2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Switch",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.flac\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP3\\shell\\NCHeditsound",
"HKEY_CLASSES_ROOT\\.arw",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\.odt",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Switch",
"HKEY_CURRENT_USER\\Software\\Classes\\.ape",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.apj",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{531FDEBF-9B4C-4A43-A2AA-960E8FCDC732}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Doxillion",
"HKEY_CLASSES_ROOT\\.rar",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile\\shell",
"HKEY_CLASSES_ROOT\\.raf",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.caf\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\exrfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\Shell\\NCHconvertdoc\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\.3gp",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ape\\UserChoice",
"HKEY_CLASSES_ROOT\\.wpd",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertdoc\\command",
"HKEY_CLASSES_ROOT\\.wps",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\.3g2",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\Shell\\NCHextract\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tiff",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.mpdp",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\drpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\.nrw",
"HKEY_CLASSES_ROOT\\Folder",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WAV\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.shn",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.png",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\gzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.aac",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MOV\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.bmp",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pngfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\NCHburn",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.cdo\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Prism",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.ddp",
"HKEY_CLASSES_ROOT\\.divx",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpdfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rarfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}",
"HKEY_CURRENT_USER\\Software\\Classes\\.ogv",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.tga\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.oga",
"HKEY_CURRENT_USER\\Software\\Classes\\.ogg",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.cab",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.m2ts",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.wp\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.srw\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gsm\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\7zfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INTERNET_SHELL_FOLDERS",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Disketch",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.exr",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.divx\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\NCHeditsound",
"HKEY_CLASSES_ROOT\\.tar.gz",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.rar",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.raf",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wav",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}",
"HKEY_CLASSES_ROOT\\.asf",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Switch",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\crwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Software\\ExpressPoints",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\VideoPad",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\arwfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.dng",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\ExpressAnimate",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WAV\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\Shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
"HKEY_CURRENT_USER\\Software\\Classes\\.wdp",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Convert sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M4A\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{04731B67-D933-450a-90E6-4ACD2E9408FE}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.TTS\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vocfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\Shell\\NCHextract\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\sr2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.divx",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.erf\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP4\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.cr2\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\Edit video file",
"HKEY_CLASSES_ROOT\\.wma",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\crwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.nrw",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.vob",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ds2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\caffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.avi",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\Shell\\Convert file type",
"HKEY_CURRENT_USER\\Software\\Classes\\.au",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Pixillion",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3G2\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LDAP",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\Desktop\\NameSpace\\DelegateFolders",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile\\shell",
"HKEY_CLASSES_ROOT\\.ape",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ddpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\NCHconvertsound",
"HKEY_CLASSES_ROOT\\.exr",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.nef\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ds2file",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.tar.gz",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.dv",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rw2file\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.avi",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cr2file\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\Shell\\Extract with Express Zip",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\divxfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\Edit video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Windows.IsoFile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AU\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{8613E14C-D0C0-4161-AC0F-1DD2563286BC}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tga\\UserChoice",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.nrw\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\CABFolder\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dss\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M2TS\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dctfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rtffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\odtfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.dv",
"HKEY_CURRENT_USER\\Software\\Classes\\.vox",
"HKEY_CURRENT_USER\\Software\\Classes\\.7z",
"HKEY_CURRENT_USER\\Software\\NCH Software\\ExpressZip",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\ExpressBurn",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\neffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\ExpressZip",
"HKEY_CURRENT_USER\\Software\\Classes\\.vob",
"HKEY_CURRENT_USER\\Software\\Classes\\.voc",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.7z\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.bz2",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\Shell\\Convert sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vpjfile\\shell",
"HKEY_CLASSES_ROOT\\.bmp",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\Shell\\NCHconvertdoc\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.npp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vpjfile",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.wpd\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\Desktop\\NameSpace",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.jp2\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\Shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nrwfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.doc",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ADTS\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.mkv",
"HKEY_CLASSES_ROOT\\.pdf",
"HKEY_CURRENT_USER\\Software\\Classes\\.jpeg",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apjfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.ts",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nppfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\srwfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.tar.gz\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vocfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\http\\OpenWithProgids",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\bz2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wp\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.htm",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jp2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.docx",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\DelegateFolders",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.shn\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\Shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile",
"HKEY_CLASSES_ROOT\\.gsm",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Paint.Picture\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{3697C5FA-60DD-4B56-92D4-74A569205C16}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\Edit video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.TTS\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.gz\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.flac\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ADTS\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.bmp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{450D8FBA-AD25-11D0-98A8-0800361B1103}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.aif",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{E429B25A-E5D3-4D1F-9BE3-0C608477E3A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\Edit sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\TIFImage.Document\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.tgz\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\voxfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wp",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wma",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mpeg2\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\NCHslideshow\\command",
"HKEY_CLASSES_ROOT\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP3\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{645FF040-5081-101B-9F08-00AA002F954E}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dctfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\.wpd",
"HKEY_CURRENT_USER\\Software\\Classes\\.pdf",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\(Default)",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Settings",
"HKEY_CURRENT_USER\\Software\\Classes\\.wps",
"HKEY_CURRENT_USER\\Software\\Classes\\.shn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.bz2",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.dng\\userchoice",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\MixPad",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\DirectUI",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\Clsid",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3GP\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tgzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\Convert sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\shnfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\Shell\\NCHconvertdoc\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\NCHburn\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\shnfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tga",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\CurVer",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docfile\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.vob\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.npp",
"HKEY_CLASSES_ROOT\\.rw2",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tgz",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tgafile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jpegfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Scheduler",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell",
"HKEY_CLASSES_ROOT\\.pgf",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dv\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tar.gzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\Convert video file",
"HKEY_CLASSES_ROOT\\.htm",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.dct\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wps",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rar\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wpd",
"HKEY_CLASSES_ROOT\\.flac",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cdofile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Registration",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{59031a47-3f72-44a7-89c5-5595fe6b30ee}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{03B5835F-F03C-411B-9CE2-AA23E1171E36}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Doxillion",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\arwfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}",
"HKEY_CURRENT_USER\\Software\\Classes\\.erf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\srffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\TIFImage.Document\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{4336a54d-038b-4685-ab02-99bb52d3fb8b}",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AU\\shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vox\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\giffile\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\NCHeditvideo\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\giffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.vpj",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Setup",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MPEG\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.srf\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apefile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.rw2\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nrwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.wav",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.doc\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{78CB5B0E-26ED-4FCC-854C-77E8F3D1AA80}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rtffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\VideoPad",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\webpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\shell\\NCHburn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vpjfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dssfile\\shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\ExpressAnimate",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\WavePad",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.caf\\UserChoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{031E4825-7B94-4dc3-B131-E946B44C8DD5}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.gz",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\shell\\NCHslideshow",
"HKEY_CLASSES_ROOT\\.aac",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tar.gzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Disketch",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dssfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.gsm",
"HKEY_CURRENT_USER\\Software\\Classes\\.gsm",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.srw\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tar.gz\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pgffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.doc\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.docx",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ds2file\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ddpfile\\shell\\open",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.ape\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\erffile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.exr\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\deprojfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pgffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jpegfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\Edit sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\.caf",
"HKEY_CURRENT_USER\\Software\\Classes\\.cab",
"HKEY_CURRENT_USER\\Software\\Classes\\.webp",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wdpfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wdpfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pngfile\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dngfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.webm",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Convert file type",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Scribe",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\MixPad",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.vpj\\userchoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.voc\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Software",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.mov",
"HKEY_CURRENT_USER\\Software\\Classes\\.vpj",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\Convert image file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.ddp",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{e345f35f-9397-435c-8f95-4e922c26259e}",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\srwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\NCHeditvideo\\command",
"HKEY_CLASSES_ROOT\\.jpg",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.bz2\\UserChoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{07EB03D6-B001-41DF-9192-BF9B841EE71F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\Create slideshow",
"HKEY_CLASSES_ROOT\\http",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.erf\\userchoice",
"HKEY_CLASSES_ROOT\\AllFilesystemObjects",
"HKEY_CLASSES_ROOT\\.tga",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell",
"HKEY_CLASSES_ROOT\\.tgz",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\apefile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.xvid",
"HKEY_CLASSES_ROOT\\.jp2",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\Shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\Shell\\Extract with Express Zip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\gsmfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tar",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\Shell\\NCHconvertdoc\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\Shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.tar.gz",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.mrw\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell",
"HKEY_CLASSES_ROOT\\.mp4",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\DreamPlan",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.vob\\UserChoice",
"HKEY_CURRENT_USER\\Software\\NCH Software\\ExpressAnimate",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Explorer",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rarfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.3gp",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\sr2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\ExpressAnimate",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\VideoPad",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\CurVer",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\Shell\\NCHextract\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mrw",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.sr2\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dngfile\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.crw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpdpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\Shell\\RegisteredApplications\\UrlAssociations\\Directory\\OpenWithProgids",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WMA\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.raf\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\ExpressZip",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\NCHconvertvideo",
"HKEY_CLASSES_ROOT\\.erf",
"HKEY_CLASSES_ROOT\\.cr2",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.dv\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\wdpfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.srf\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\Shell\\NCHextract\\command",
"HKEY_CLASSES_ROOT\\.srf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3G2\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\Shell\\NCHextract",
"HKEY_CLASSES_ROOT\\.srw",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AU\\Shell",
"HKEY_CLASSES_ROOT\\FirefoxURL-E7CF176E110C211B",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.jp2\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\Shell\\NCHconvertdoc\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria",
"HKEY_CURRENT_USER\\Software\\Classes\\ddpfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.deproj",
"HKEY_CLASSES_ROOT\\.sr2",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Scribe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\NCHconvertvideo\\command",
"HKEY_CLASSES_ROOT\\.mov",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\DelegateFolders",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Crescendo",
"HKEY_CLASSES_ROOT\\.au",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions",
"HKEY_CURRENT_USER\\Software\\Classes\\.ts",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\Edit video file",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\AccessProviders",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WAV\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.pgf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AIFF\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.wma",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mrw\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tar\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.pgf\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Disketch",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.aif",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\NCHeditvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WMA\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.nef",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Scribe",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\flacfile\\Shell",
"HKEY_CLASSES_ROOT\\.wp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\LayoutIcon\\0409\\0000041d",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\Shell\\NCHconvertimage",
"HKEY_CLASSES_ROOT\\.rtf",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\PhotoStage",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\.cr2",
"HKEY_CLASSES_ROOT\\.m4v",
"HKEY_CURRENT_USER\\Software\\Classes\\.gif",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\spjfile",
"HKEY_CLASSES_ROOT\\.m4a",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\NCHconvertvideo\\command",
"HKEY_CLASSES_ROOT\\.caf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\xvidfile\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.cab",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\nchsetup.exe",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\Edit sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jpegfile\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\srffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MPEG\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\DrawPad",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wdpfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cdofile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.sr2\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.raf\\UserChoice",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.spj\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.gz\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.arw\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ADTS\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.dct",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jpegfile\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.rw2",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vpjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AVI\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\spjfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tar.gzfile\\Shell\\Extract with Express Zip",
"HKEY_CLASSES_ROOT\\.tar",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.dss\\userchoice",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\(Default)",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Doxillion",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\nchsetup.exe",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ASF\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\Shell\\Convert file type",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mrwfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nppfile",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\.gz",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP3\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.webp",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.nrw\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.mp3",
"HKEY_CURRENT_USER\\Software\\Classes\\.mp4",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mp4",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AVI\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mp3",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.crw\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Prism",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mpg",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tarfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.spj",
"HKEY_CLASSES_ROOT\\.3g2",
"HKEY_CURRENT_USER\\Software\\NCH Software\\WavePad",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apjfile\\shell",
"HKEY_CLASSES_ROOT\\.mrw",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.mpg",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\ExpressBurn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\ExpressPoints",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpeg2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\raffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PropertyBag",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.mpdp\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.bz2\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MOV\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell",
"HKEY_CLASSES_ROOT\\.nef",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.voc\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.drp",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\KnownClasses",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.rtf",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{C1EE01F2-B3B6-4A6A-9DDD-E988C088EC82}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\Shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\Clsid",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\.tgz",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
"HKEY_CURRENT_USER\\Software\\Classes\\gzfile\\Shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ds2file\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.divx",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\Shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Classes\\.tga",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Windows.IsoFile\\shell\\NCHburn",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.spj",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.7z\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Pixillion",
"HKEY_CLASSES_ROOT\\.gz",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_CLASSES_ROOT\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Classes\\.html",
"HKEY_CLASSES_ROOT\\Interface\\{618736E0-3C3D-11CF-810C-00AA00389B71}\\ProxyStubClsid32",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\ddpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\spjfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tgzfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.webp\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\shell\\NCHconvertvideo",
"HKEY_CLASSES_ROOT\\.ds2",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.cr2\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mov",
"HKEY_CLASSES_ROOT\\.gif",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\webpfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\gsmfile\\Shell\\NCHconvertsound",
"HKEY_CLASSES_ROOT\\.webp",
"HKEY_CLASSES_ROOT\\.webm",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mkvfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vobfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\arwfile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\giffile\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Paint.Picture\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\xvidfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\Edit video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_USE_IETLDLIST_FOR_DOMAIN_DETERMINATION",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpsfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\Shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Classes\\apjfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.docx",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\apefile\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\Shell\\NCHconvertdoc\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.caf",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.ddp\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\Shell\\Extract with Express Zip",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.iso",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.iso",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\odtfile\\shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\.nef",
"HKEY_CLASSES_ROOT\\.iso",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pngfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.rtf",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.pgf",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\NCHconvertsound",
"HKEY_CLASSES_ROOT\\.m2ts",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cr2file\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\7zfile\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.tgz\\UserChoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg 2",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\NCH Software\\ExpressBurn",
"HKEY_CURRENT_USER\\Software\\Classes\\.mkv",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Switch",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\giffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.wp",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.divx\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.ds2",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP4\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
"HKEY_CURRENT_USER\\Software\\NCH Software\\VideoPad",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F25E9F57-2FC8-4EB3-A41A-CCE5F08541E6}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dctfile\\shell",
"HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
"HKEY_CURRENT_USER\\Software\\Classes\\.m4v",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.dss",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\.tiff",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\drpfile\\shell",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\Edit video file",
"HKEY_CLASSES_ROOT\\.ts",
"HKEY_CLASSES_ROOT\\.xvid",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rw2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\",
"HKEY_CURRENT_USER\\Software\\Classes\\dvfile\\Shell",
"HKEY_CURRENT_USER\\Software\\NCH Software\\PhotoStage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.7z",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\Clsid",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\DreamPlan",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.dng\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\.jp2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\pngfile\\shell\\NCHslideshow",
"HKEY_CLASSES_ROOT\\.bz2",
"HKEY_CLASSES_ROOT\\.aiff",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.drp",
"HKEY_CLASSES_ROOT\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\InProcServer32",
"HKEY_CLASSES_ROOT\\.nrw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\cdofile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.m4v",
"HKEY_CURRENT_USER\\Software\\Classes\\.xvid",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.3g2",
"HKEY_CURRENT_USER\\Software\\Classes\\jp2file\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AIFF\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpdpfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\Shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\mpeg2file\\Shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\PropertyBag",
"HKEY_CLASSES_ROOT\\.mp3",
"HKEY_CURRENT_USER\\Software\\Classes\\.sr2",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\rtffile\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ASF\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\flacfile\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.odt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\Shell\\Convert file type",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\nchsetup.exe",
"HKEY_CURRENT_USER\\Software\\Classes\\.srf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dssfile",
"HKEY_CLASSES_ROOT\\.vox",
"HKEY_CLASSES_ROOT\\.mpg",
"HKEY_CLASSES_ROOT\\.vob",
"HKEY_CLASSES_ROOT\\.voc",
"HKEY_CURRENT_USER\\Software\\Classes\\.srw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Paint.Picture\\shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\DefaultIcon",
"HKEY_CLASSES_ROOT\\Directory",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AIFF\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Registration\\NCH",
"HKEY_CLASSES_ROOT\\.avi",
"HKEY_CLASSES_ROOT\\.mpeg2",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\voxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PropertyBag",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.cr2",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Crescendo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}",
"HKEY_CURRENT_USER\\Software\\Classes\\drpfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.aiff",
"HKEY_CURRENT_USER\\Software\\Classes\\wdpfile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.crw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.jpeg",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Blocked",
"HKEY_CURRENT_USER\\Software\\Classes\\wpdfile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.crw",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Scribe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\deprojfile\\shell\\open\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.sr2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\\nchsetup.exe",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\Shell\\Convert file type",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\.cdo",
"HKEY_CURRENT_USER\\Software\\Classes\\.tar",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.srw",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.srf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.odt",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\NCHextract\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.jp2",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Disketch",
"HKEY_CLASSES_ROOT\\.shn",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.m4a",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.dss",
"HKEY_CURRENT_USER\\Software\\Classes\\.m4a",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AVI\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Prism",
"HKEY_CURRENT_USER\\Software\\NCH Software\\MixPad",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.jpg",
"HKEY_CURRENT_USER\\Software\\Classes\\.dng",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\.jpg",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.ASF\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.mrw",
"HKEY_CURRENT_USER\\Software\\Classes\\srffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.ds2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
"HKEY_CURRENT_USER\\Software\\Classes\\.rw2",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{11016101-E366-4D22-BC06-4ADA335C892B}",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MOV\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\NCHslideshow\\command",
"HKEY_CLASSES_ROOT\\.png",
"HKEY_CLASSES_ROOT\\.doc",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\(Default)",
"HKEY_CURRENT_USER\\Software\\Classes\\TIFImage.Document\\shell\\NCHconvertimage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.gif",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AIFF\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\CABFolder\\shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Windows.IsoFile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Paint.Picture\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Objects\\{871C5380-42A0-1069-A2EA-08002B30309D}",
"HKEY_CURRENT_USER\\Software\\Classes\\mpdpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\DreamPlan",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.ds2\\userchoice",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\shell\\",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell\\NCHslideshow\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mrwfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.arw\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MPEG\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3GP\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\ds2file\\Shell\\NCHconvertsound",
"HKEY_CLASSES_ROOT\\.html",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.asf",
"HKEY_CURRENT_USER\\Software\\Classes\\shnfile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\Explorer",
"HKEY_CURRENT_USER\\Software\\Classes\\.asf",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.pgf\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\Edit sound file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.crw\\UserChoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{9343812e-1c37-4a49-a12e-4b2d810d956b}",
"HKEY_CURRENT_USER\\Software\\NCH Software\\DrawPad",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\dctfile",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\vobfile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.xvid\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Crescendo",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\Prism",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\jp2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dvfile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\gsmfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\.mpeg2",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.apj\\userchoice",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PropertyBag",
"HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.mkv\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpdfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\.doc",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\PhotoStage",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\TIFImage.Document\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\docxfile\\Shell\\NCHconvertdoc\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\neffile\\Shell",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.tar\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\erffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.voc",
"HKEY_CURRENT_USER\\Software\\Classes\\caffile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\vobfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\raffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WMA\\Shell\\Convert sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docxfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mpeg",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\Shell\\NCHslideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.vox",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\spjfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\NCHeditsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3GP\\shell\\NCHconvertvideo",
"HKEY_CLASSES_ROOT\\.dv",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.TTS\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\NCHconvertvideo\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Pixillion",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3G2\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M4A\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\NCHconvertimage\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.png",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\Edit sound file",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M2TS\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell\\NCHconvertsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList",
"HKEY_CURRENT_USER\\Software\\Classes\\srwfile\\Shell\\Create slideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\Shell\\NCHeditvideo\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile\\shell\\open\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}",
"HKEY_CURRENT_USER\\Software\\Classes\\tgafile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\ExpressPoints",
"HKEY_CURRENT_USER\\Software\\Classes\\.arw",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.arw",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\Shell",
"HKEY_CLASSES_ROOT\\.dng",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\deprojfile\\shell\\open",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\caffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\voxfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{daf95313-e44d-46af-be1b-cbacea2c3065}",
"HKEY_CURRENT_USER\\Software\\Classes\\bz2file\\Shell\\Extract with Express Zip",
"HKEY_CURRENT_USER\\Software\\Classes\\rtffile\\Shell\\NCHconvertdoc",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Edit video file",
"HKEY_CLASSES_ROOT\\.3gp",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\exrfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\raffile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\exrfile\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.wps\\userchoice",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\ExpressZip",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.deproj\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M2TS\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.3G2\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.mpeg",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\Directory",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\Crescendo",
"HKEY_CURRENT_USER\\Software\\Classes\\.flac",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.exr\\UserChoice",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.vox\\userchoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.3GP\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\Convert video file",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\wpfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\sr2file\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
"HKEY_CURRENT_USER\\Software\\Classes\\dngfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AVI\\shell\\NCHeditvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\nppfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\Shell\\NCHconvertsound",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tarfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\NCHeditsound\\command",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\MixPad",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.aac",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.wdp",
"HKEY_CURRENT_USER\\Software\\Classes\\xvidfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\NCHslideshow",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell\\NCHconvertvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MOV\\Shell\\Convert video file",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{26EE0668-A00A-44D7-9371-BEB064C98683}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.tiff",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\wpsfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\webpfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\pngfile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\divxfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\odtfile\\Shell\\Convert file type",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditsound",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.rw2\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ASF\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\neffile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\odtfile\\Shell",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\giffile\\Shell\\Convert image file",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.webp\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\mrwfile\\Shell\\NCHconvertimage\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_CURRENT_USER\\Software\\Classes\\.raf",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dvfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\nrwfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\tarfile\\Shell\\NCHextract\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\.rar",
"HKEY_CURRENT_USER\\Software\\Classes\\tgzfile\\Shell\\NCHextract\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{A028AE76-01B1-46C2-99C4-ACD9858AE02F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\Shell\\Burn with Express Burn",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpeg2file\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.dct",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.TTS\\DefaultIcon",
"HKEY_CLASSES_ROOT\\.ogg",
"HKEY_CLASSES_ROOT\\.aif",
"HKEY_CLASSES_ROOT\\.oga",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{89D83576-6BD1-4c86-9454-BEB04E94C819}",
"HKEY_CLASSES_ROOT\\.ogv",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mkv",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Pixillion",
"HKEY_CURRENT_USER\\Software\\Classes\\Paint.Picture\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.drp\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\cr2file\\Shell\\Create slideshow",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.mpdp",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.erf",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\Inventoria\\Service",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MPEG\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
"HKEY_CURRENT_USER\\Software\\Classes\\.aiff",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.WMA\\shell\\NCHeditsound",
"HKEY_CLASSES_ROOT\\.jpeg",
"HKEY_CURRENT_USER\\Software\\Classes\\FirefoxHTML-E7CF176E110C211B\\Shell\\NCHconvertsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.M2TS\\shell\\NCHeditvideo",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\crwfile\\Shell\\NCHslideshow\\command",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wpd\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.ADTS\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.au",
"HKEY_CURRENT_USER\\Software\\Classes\\pgffile\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\NCH Swift Sound\\WavePad",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\gzfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\docxfile\\shell\\NCHconvertdoc",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\CABFolder\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\jpegfile\\Shell\\NCHconvertimage",
"HKEY_CURRENT_USER\\Software\\Classes\\wpsfile\\Shell\\Convert file type",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\deprojfile",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\rw2file\\Shell",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\WavePad",
"HKEY_CURRENT_USER\\Software\\Classes\\rarfile\\Shell\\NCHextract\\command",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.AU\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\vocfile\\Shell\\NCHeditsound",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.WAV\\DefaultIcon",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\7zfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.M4A\\shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{AE6BE008-07FB-400D-8BEB-337A64F7051F}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\.m2ts",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\mpdpfile",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.wps\\UserChoice",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\dssfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce",
"HKEY_CURRENT_USER\\Software\\Classes\\Windows.IsoFile\\shell\\NCHextract",
"HKEY_LOCAL_MACHINE\\Software\\NCH Software\\DrawPad",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\.deproj",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Blocked",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\WMP11.AssocFile.MP4\\shell\\NCHconvertvideo",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\erffile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Swift Sound\\PhotoStage",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{F89E9E58-BD2F-4008-9AC2-0F816C09F4EE}\\Category\\Category\\{534C48C1-0607-4098-A521-4FC899C73E90}",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP4\\Shell\\NCHconvertvideo\\command",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Settings",
"HKEY_CURRENT_USER\\Software\\Classes\\flacfile\\Shell",
"HKEY_CURRENT_USER\\Software\\Classes\\dssfile\\Shell\\NCHconvertsound\\command",
"HKEY_CURRENT_USER\\Software\\Classes\\nppfile\\shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\drpfile\\shell\\open",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\DefaultIcon",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.nef\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\Convert sound file",
"HKEY_CURRENT_USER\\Software\\Classes\\cdofile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell\\NCHconvertvideo\\command",
"HKEY_CLASSES_ROOT\\.7z",
"HKEY_CURRENT_USER\\software\\microsoft\\windows\\currentversion\\explorer\\fileexts\\.shn\\userchoice",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\Shell\\Edit video file",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.MP3\\Shell\\NCHeditsound",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Windows.IsoFile\\shell\\NCHextract",
"HKEY_CURRENT_USER\\Software\\Classes\\docfile\\Shell",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\tgafile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\Classes\\WMP11.AssocFile.AU\\Shell\\NCHeditsound",
"HKEY_CLASSES_ROOT\\.wav",
"HKEY_CURRENT_USER\\Software\\Classes\\mkvfile\\DefaultIcon",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Doxillion",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileExts\\.ds2\\UserChoice",
"HKEY_CURRENT_USER\\Software\\Classes\\divxfile\\Shell",
"HKEY_CURRENT_USER\\Software\\NCH Software\\DreamPlan",
"HKEY_CURRENT_USER\\Software\\Classes\\CABFolder\\Shell\\NCHextract\\command",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
],
"file_moved": [
[
"C:\\ProgramData\\NCH Software\\Inventoria\\Tax.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\Tax.dat"
],
[
"C:\\ProgramData\\NCH Software\\Inventoria\\Options.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\Options.dat"
],
[
"C:\\ProgramData\\NCH Software\\Inventoria\\Company.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\Company.dat"
],
[
"C:\\ProgramData\\NCH Software\\Inventoria\\Order.dat",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\Order.dat"
]
],
"file_written": [
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\options.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\print.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\favicon.ico",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\downsort.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\vl.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\categories.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\edit.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datepicker.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\side_image.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\items.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\table.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_over.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\greybg.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\ajax.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\down.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\purchase.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\suppliers.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\combobox.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\orders.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\reports.jpg",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\select_arrow_down.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\upsort.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\users.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\s.css",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\postfile.js",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\schedule.bmp",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\locations.jpg",
"C:\\Users\\cuck\\Favorites\\NCH Software Download Site.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\view.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\trash.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\darkblue.gif",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\cal.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\customers.jpg",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\arrow_blue.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\transfer.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\popup.js",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\sell.gif",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\up.gif",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\datetime.js"
],
"regkey_deleted": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Software\\_InstalledBy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\_UserSpecific",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\UserSpecific",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\InventoriaInstall",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Software\\InstalledBy"
],
"file_deleted": [
"",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\InventoriaCounts.txt"
],
"directory_removed": [
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\testfolder"
],
"file_exists": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite",
"C:\\Program Files (x86)\\NCH Software",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs",
"C:\\ProgramData\\NCH Software\\Inventoria\\Logs",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\Windows\\SysWOW64\\ieframe.dll",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe",
"C:\\Users\\Public\\Desktop\\NCH Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\NCH Software\\Program Files\\Inventoria",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\NCH Software",
"C:\\Users\\cuck\\Favorites\\NCH Software Download Site.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk"
],
"file_failed": [
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\Users\\cuck\\Desktop\\NCH Suite.lnk\\desktop.ini",
"C:\\Users\\Public\\Desktop\\NCH Software.lnk",
"C:\\Users\\Public\\Desktop\\NCH Software.lnk\\desktop.ini",
"C:\\Users\\cuck\\Desktop\\NCH Suite.lnk",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk\\desktop.ini",
"C:\\Users\\cuck\\Desktop\\NCH Software.lnk",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"C:\\Users\\cuck\\Desktop\\NCH Software.lnk\\desktop.ini"
],
"guid": [
"{5762f2a7-4658-4c7a-a4ac-bdabfe154e0d}",
"{000214f9-0000-0000-c000-000000000046}",
"{00021401-0000-0000-c000-000000000046}",
"{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}",
"{2faba4c7-4da9-4013-9697-20cc3fd40f85}",
"{871c5380-42a0-1069-a2ea-08002b30309d}",
"{000214e6-0000-0000-c000-000000000046}",
"{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}"
],
"file_read": [
"C:\\Users\\cuck\\Desktop\\desktop.ini",
"C:\\Program Files (x86)\\desktop.ini",
"C:\\Windows\\SysWOW64\\ieframe.dll",
"C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat"
],
"regkey_read": [
"HKEY_CURRENT_USER\\mrwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParsingName",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\InProcServer32\\LoadWithoutCOM",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{daf95313-e44d-46af-be1b-cbacea2c3065}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\tarfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aiff\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\odtfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpeg\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName",
"HKEY_CURRENT_USER\\tgzfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CABFolder\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\StreamResourceType",
"HKEY_CURRENT_USER\\neffile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AVI\\shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Favorites",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp4\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MPEG\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.wma\\shell\\(Default)",
"HKEY_CURRENT_USER\\caffile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
"HKEY_CURRENT_USER\\dngfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParsingName",
"HKEY_CURRENT_USER\\voxfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\FolderTypeID",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\wdpfile\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Icon",
"HKEY_CURRENT_USER\\.pdf\\(Default)",
"HKEY_CURRENT_USER\\wpsfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.iso\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_CURRENT_USER\\.dng\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\InfoTip",
"HKEY_CURRENT_USER\\crwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4v\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.bmp\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Security",
"HKEY_CURRENT_USER\\rarfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\.ogg\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\wdpfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PreCreate",
"HKEY_CURRENT_USER\\divxfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\jpegfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.htm\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpg\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mov\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wav\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\AllowFileCLSIDJunctions",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.TTS\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\CommonFilesDir",
"HKEY_CURRENT_USER\\docxfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\ParentFolder",
"HKEY_CURRENT_USER\\vobfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\LdapClientIntegrity",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionLow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.srf\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\StreamResourceType",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_CURRENT_USER\\.cr2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INTERNET_SHELL_FOLDERS\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{BD7A2E7B-21CB-41b2-A086-B309680C6B7E}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionLow",
"HKEY_CURRENT_USER\\.vox\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Attributes",
"HKEY_CURRENT_USER\\pgffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\DevicePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowTypeOverlay",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Icon",
"HKEY_CURRENT_USER\\neffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\CurrentVersion",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{871C5380-42A0-1069-A2EA-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\FolderTypeID",
"HKEY_CURRENT_USER\\raffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\ProgramFilesDir",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Icon",
"HKEY_CURRENT_USER\\apefile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
"HKEY_CURRENT_USER\\flacfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\ProfilesDirectory",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.3GP\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\StreamResource",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Pictures",
"HKEY_CURRENT_USER\\vocfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.ADTS\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{208D2C60-3AEA-1069-A2D7-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\ParentFolder",
"HKEY_CURRENT_USER\\dssfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\giffile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\TIP\\{0000897b-83df-4b96-be07-0fb58b01c4a4}\\LanguageProfile\\0x00000000\\{0001bea3-ed56-483d-a2e2-aeae25577436}\\Enable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\LocalizedName",
"HKEY_CURRENT_USER\\mrwfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.cab\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Name",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}",
"HKEY_CURRENT_USER\\tgafile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\InProcServer32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\InitFolderHandler",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
"HKEY_CURRENT_USER\\ds2file\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\SourcePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{374DE290-123F-4565-9164-39C4925E467B}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CABFolder\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseOldHostResolutionOrder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.m4a\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{89D83576-6BD1-4c86-9454-BEB04E94C819}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\PinToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.rtf\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Roamable",
"HKEY_CURRENT_USER\\.voc\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.jpg\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldDllVersionHigh",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\ParentFolder",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.odt\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tar\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Attributes",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\CommonVideo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{031E4825-7B94-4dc3-B131-E946B44C8DD5}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AVI\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\rtffile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AU\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.png\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.TS\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.dct\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.vob\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\giffile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Attributes",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Music",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\dssfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tiff\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\My Video",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TIFImage.Document\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AU\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\CommonMusic",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_CURRENT_USER\\xvidfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\UninstallString",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\GlobalAssocChangedCounter",
"HKEY_CURRENT_USER\\http\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_CURRENT_USER\\docfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Stream",
"HKEY_CURRENT_USER\\.webm\\(Default)",
"HKEY_CURRENT_USER\\webpfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\*",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MP3\\shell\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\PreCreate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.WAV\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Category",
"HKEY_CURRENT_USER\\TIFImage.Document\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut",
"HKEY_CURRENT_USER\\wpfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_CURRENT_USER\\.flac\\(Default)",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\AccessProviders\\MartaExtension",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\jp2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mpeg\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Security",
"HKEY_CURRENT_USER\\.xvid\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Icon",
"HKEY_CURRENT_USER\\cr2file\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\StreamResource",
"HKEY_CURRENT_USER\\voxfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\NoFileFolderJunction",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\StreamResource",
"HKEY_CURRENT_USER\\.divx\\(Default)",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Stream",
"HKEY_CURRENT_USER\\.mrw\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{B4FB3F98-C1EA-428d-A78A-D1F5659CBA93}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallDateFirst",
"HKEY_CURRENT_USER\\srffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Security",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AIFF\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gz\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.ADTS\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\LocalizedName",
"HKEY_CURRENT_USER\\mpeg2file\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.M2TS\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.3G2\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{04731B67-D933-450a-90E6-4ACD2E9408FE}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MOV\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.AIFF\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.3G2\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource",
"HKEY_CURRENT_USER\\exrfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Stream",
"HKEY_CURRENT_USER\\bz2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\mkvfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{450D8FBA-AD25-11D0-98A8-0800361B1103}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\InfoTip",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{56784854-C6CB-462B-8169-88E350ACB882}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Stream",
"HKEY_CURRENT_USER\\rtffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PreCreate",
"HKEY_CURRENT_USER\\.dss\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\FolderTypeID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
"HKEY_CURRENT_USER\\.nrw\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsFORDISPLAY",
"HKEY_CURRENT_USER\\.html\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\CTF\\EnableAnchorContext",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\RelativePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b5-70f9-11e8-b07b-806e6f6e6963}\\Generation",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Stream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Paint.Picture\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{ED228FDF-9EA8-4870-83b1-96b02CFE0D52}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{3f5cc1b6-70f9-11e8-b07b-806e6f6e6963}\\Data",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Paint.Picture\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Attributes",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Attributes",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\.mpeg2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\Common Programs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.M2TS\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3gp\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.AAC\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Windows.IsoFile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.WAV\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{9343812e-1c37-4a49-a12e-4b2d810d956b}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Layout Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable",
"HKEY_CURRENT_USER\\.vob\\(Default)",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\EnableSchedule",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.M4A\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\UseDropHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.3g2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.docx\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\PreCreate",
"HKEY_CURRENT_USER\\FirefoxURL-E7CF176E110C211B\\ShellFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\7zfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\MapNetDriveVerbs",
"HKEY_CURRENT_USER\\CABFolder\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.M2TS\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MP4\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\StreamResource",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
"HKEY_CURRENT_USER\\vobfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.asf\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoNetCrawling",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Programs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wdp\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Name",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Attributes",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\ParsingName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Category",
"HKEY_CURRENT_USER\\.srw\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.mp3\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Windows.IsoFile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\LocalizedName",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name",
"HKEY_CURRENT_USER\\.nef\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\InitFolderHandler",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.3GP\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\pngfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Icon",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\Attributes",
"HKEY_CURRENT_USER\\sr2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\HideFolderVerbs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.gif\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Description",
"HKEY_CURRENT_USER\\cr2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.ASF\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_INTERNET_SHELL_FOLDERS\\nchsetup.exe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\CommonPictures",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\LocalRedirectOnly",
"HKEY_CURRENT_USER\\tar.gzfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\LocalizedName",
"HKEY_CURRENT_USER\\.oga\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\AppData",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalizedName",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.M4A\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\rtffile\\shell\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Cache",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Language Hotkey",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName",
"HKEY_CURRENT_USER\\Keyboard Layout\\Toggle\\Hotkey",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LDAP\\UseHostnameAsAlias",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType",
"HKEY_CURRENT_USER\\dvfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\LocalizedName",
"HKEY_CURRENT_USER\\ds2file\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsFORPARSING",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\docxfile\\shell\\(Default)",
"HKEY_CURRENT_USER\\.crw\\(Default)",
"HKEY_CURRENT_USER\\erffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\Interface\\{618736E0-3C3D-11CF-810C-00AA00389B71}\\ProxyStubClsid32\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\InitFolderHandler",
"HKEY_CURRENT_USER\\giffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MPEG\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Name",
"HKEY_CURRENT_USER\\.jp2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Internet Explorer\\MAIN\\FeatureControl\\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\\nchsetup.exe",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsUniversalDelegate",
"HKEY_CURRENT_USER\\gzfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\QueryForInfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\QueryForOverlay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
"HKEY_CURRENT_USER\\pngfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Category",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Stream",
"HKEY_CURRENT_USER\\.ogv\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\WantsParseDisplayName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MP3\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_CURRENT_USER\\srwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\Roamable",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\HideOnDesktopPerUser",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MP4\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.wma\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\RestrictedAttributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\Public",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached\\{871C5380-42A0-1069-A2EA-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0xFFFF",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID",
"HKEY_CURRENT_USER\\divxfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.dv\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\Description",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\StreamResource",
"HKEY_CURRENT_USER\\srwfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Stream",
"HKEY_CURRENT_USER\\vocfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\shnfile\\Shell\\(Default)",
"HKEY_CURRENT_USER\\gsmfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{e345f35f-9397-435c-8f95-4e922c26259e}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{33E28130-4E1E-4676-835A-98395C3BC3BB}\\Stream",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\Common Startup",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DFDF76A2-C82A-4D63-906A-5644AC457385}\\Description",
"HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\CreateUriCacheSize",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\StreamResource",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Category",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\odtfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{11016101-E366-4D22-BC06-4ADA335C892B}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B97D20BB-F46A-4C97-BA10-5E3608430854}\\StreamResourceType",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.doc\\(Default)",
"HKEY_CURRENT_USER\\wpdfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\docxfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Roamable",
"HKEY_CURRENT_USER\\.caf\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{26EE0668-A00A-44D7-9371-BEB064C98683}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Stream",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\pngfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.avi\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.MOV\\shell\\(Default)",
"HKEY_CURRENT_USER\\.mkv\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\InitFolderHandler",
"HKEY_CURRENT_USER\\.ds2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.aif\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Roamable",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\User Shell Folders\\Common Documents",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.wma\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE974D24-D9C6-4D3E-BF91-F4455120B917}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\ParsingName",
"HKEY_CURRENT_USER\\rw2file\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Security_HKLM_only",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.ASF\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{82A5EA35-D9CD-47C5-9629-E15D2F714E6E}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3D644C9B-1FB8-4F30-9B45-F670235F79C0}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\Description",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F7F1ED05-9F6D-47A2-AAAE-29D317C6F066}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{DE92C1C7-837F-4F69-A3BB-86E631204A23}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4C5C32FF-BB9D-43B0-B5B4-2D72E54EAAA4}\\InfoTip",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\ShellFolder\\WantsAliasedNotifications",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\EnablePunycode",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{3214FAB5-9757-4298-BB61-92A9DEAA44FF}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\FolderTypeID",
"HKEY_CURRENT_USER\\dvfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1777F761-68AD-4D8A-87BD-30B759FA33DD}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\PreCreate",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{0762D272-C50A-4BB0-A382-697DCD729B80}\\Icon",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\TIFImage.Document\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\PublishExpandedPath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.tgz\\(Default)",
"HKEY_CURRENT_USER\\arwfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{2400183A-6185-49FB-A2D8-4A392A602BA3}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.au\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\Desktop\\NameSpace\\{645FF040-5081-101B-9F08-00AA002F954E}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Associations\\UrlAssociations\\http\\UserChoice\\Progid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{374DE290-123F-4565-9164-39C4925E467B}\\ParsingName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\Security",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5}\\LocalRedirectOnly",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\WMP11.AssocFile.TTS\\shell\\(Default)",
"HKEY_CURRENT_USER\\odtfile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\HideInWebView",
"HKEY_CURRENT_USER\\caffile\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{A77F5D77-2E2B-44C3-A6A2-ABA601054A51}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSimpleStartMenu",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{52A4F021-7B75-48A9-9F6B-4B87A210BC8F}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description",
"HKEY_CURRENT_USER\\nrwfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{56784854-C6CB-462B-8169-88E350ACB882}\\InitFolderHandler",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Wow6432Node\\CLSID\\{871C5380-42A0-1069-A2EA-08002B30309D}\\ShellFolder\\HasNavigationEnum",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{ED4824AF-DCE4-45A8-81E2-FC7965083634}\\FolderTypeID",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{4BD8D571-6D19-48D3-BE97-422220080E43}\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE}\\Roamable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\IETld\\IETldVersionHigh",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{18989B1D-99B5-455B-841C-AB7C74E4DDFC}\\ParentFolder",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{5E6C858F-0E22-4760-9AFE-EA3317B67173}\\Attributes",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\jpegfile\\shell\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FolderDescriptions\\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}\\Category"
],
"directory_enumerated": [
"C:\\ProgramData\\NCH Software\\Inventoria\\*.*",
"C:\\ProgramData\\NCH Software\\Inventoria\\Misc\\*.*",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\*.*",
"C:\\Windows\\SysWOW64",
"C:\\Windows\\SysWOW64\\ieframe.dll",
"C:\\Windows\\SysWOW64\\*.*",
"C:\\ProgramData\\NCH Software\\Inventoria\\Web\\*.*",
"C:\\ProgramData\\NCH Software\\Inventoria\\Logs\\*.*",
"C:\\Windows"
],
"regkey_written": [
"HKEY_CURRENT_USER\\sr2file\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\divxfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\dvfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\nppfile\\(Default)",
"HKEY_CURRENT_USER\\neffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\dvfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\dssfile\\shell\\open\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Service\\StartType",
"HKEY_CURRENT_USER\\apefile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\spjfile\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\VersionMajor",
"HKEY_CURRENT_USER\\deprojfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\caffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\tgafile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.raf\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\exrfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Settings\\InstallerPath",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\vobfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\cdofile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\webpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\arwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\giffile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\7zfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\URLUpdateInfo",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\vpjfile\\(Default)",
"HKEY_CURRENT_USER\\pgffile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\.sr2\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\EstimatedSize",
"HKEY_CURRENT_USER\\vocfile\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\caffile\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\.dng\\(Default)",
"HKEY_CURRENT_USER\\shnfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\tar.gzfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\.pgf\\(Default)",
"HKEY_CURRENT_USER\\odtfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\dctfile\\(Default)",
"HKEY_CURRENT_USER\\tgzfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\pngfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\tgzfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\wpdfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.crw\\(Default)",
"HKEY_CURRENT_USER\\voxfile\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\nppfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\Version",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\NetworkFolder",
"HKEY_CURRENT_USER\\.erf\\(Default)",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\NCHburn\\command\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\erffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.dss\\(Default)",
"HKEY_CURRENT_USER\\.ape\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\rarfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.cr2\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\DisplayVersion",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\wpsfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\CABFolder\\Shell\\NCHextract\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Scheduler\\SchedBackup",
"HKEY_CURRENT_USER\\srwfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\.vox\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\rw2file\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\apjfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\srwfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\pngfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\NCHconvertsound\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\CurrentVersion",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\tgafile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\arwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\wpsfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\.webp\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\rarfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.wpd\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\rarfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\gzfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\wpdfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\caffile\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\webpfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\pngfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\divxfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\rw2file\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\raffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.rw2\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\shnfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\neffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.tgz\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\NCHconvertsound\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\UninstallString",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\neffile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\.voc\\(Default)",
"HKEY_CURRENT_USER\\docxfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\gsmfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\DisplayIcon",
"HKEY_CURRENT_USER\\jp2file\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\.shn\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Service\\Installed",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\voxfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\.cdo\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstalledByAdmin",
"HKEY_CURRENT_USER\\dssfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\apefile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\srffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\.exr\\(Default)",
"HKEY_CURRENT_USER\\caffile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallerPath",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\GlobalAssocChangedCounter",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallerName",
"HKEY_CURRENT_USER\\.doc\\(Default)",
"HKEY_CURRENT_USER\\arwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AU\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\dvfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\giffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.apj\\(Default)",
"HKEY_CURRENT_USER\\rtffile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\mpdpfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.TTS\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\nppfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\mpeg2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\wpfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\wpfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\voxfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\deprojfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\TIFImage.Document\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.mrw\\(Default)",
"HKEY_CURRENT_USER\\neffile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\NCHburn\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallDateFirst",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\odtfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\cdofile\\(Default)",
"HKEY_CURRENT_USER\\ddpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\vobfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\VersionMinor",
"HKEY_CURRENT_USER\\tar.gzfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\Windows.IsoFile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\apjfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\exrfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ADTS\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\.nrw\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\.gz\\(Default)",
"HKEY_CURRENT_USER\\drpfile\\(Default)",
"HKEY_CURRENT_USER\\wpdfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\7zfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.xvid\\(Default)",
"HKEY_CURRENT_USER\\.deproj\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Service\\Enabled",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\apjfile\\(Default)",
"HKEY_CURRENT_USER\\erffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\pgffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AVI\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\.flac\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\.wps\\(Default)",
"HKEY_CURRENT_USER\\.vob\\(Default)",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\EnableSchedule",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\webpfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MPEG\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\.bz2\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP3\\Shell\\NCHeditsound\\(Default)",
"HKEY_CURRENT_USER\\cdofile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\TIFImage.Document\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\Option",
"HKEY_CURRENT_USER\\tarfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MP4\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\spjfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\.tga\\(Default)",
"HKEY_CURRENT_USER\\vobfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\gsmfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\docfile\\Shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\bz2file\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Registration\\NCH\\Inventoria",
"HKEY_CURRENT_USER\\voxfile\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Service\\StartTypeText",
"HKEY_CURRENT_USER\\divxfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\vocfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\divxfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\.divx\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\ddpfile\\(Default)",
"HKEY_CURRENT_USER\\.7z\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3G2\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\.srw\\(Default)",
"HKEY_CURRENT_USER\\7zfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\.ddp\\(Default)",
"HKEY_CURRENT_USER\\dssfile\\shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.nef\\(Default)",
"HKEY_CURRENT_USER\\tgafile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\dctfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\InventoriaInstall",
"HKEY_CURRENT_USER\\sr2file\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\.mpdp\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\voxfile\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\pgffile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\tarfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\wpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\vobfile\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\deprojfile\\(Default)",
"HKEY_CURRENT_USER\\mrwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\docxfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\docfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\cr2file\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\giffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.wp\\(Default)",
"HKEY_CURRENT_USER\\vocfile\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\docfile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\neffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\InstallDate",
"HKEY_CURRENT_USER\\tgzfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\dssfile\\(Default)",
"HKEY_CURRENT_USER\\CABFolder\\Shell\\NCHextract\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\InstallLocation",
"HKEY_CURRENT_USER\\dvfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\gzfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditsound\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\Publisher",
"HKEY_CURRENT_USER\\raffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\mpdpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\xvidfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\URLInfoAbout",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M2TS\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\raffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.jp2\\(Default)",
"HKEY_CURRENT_USER\\vobfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\dssfile\\shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\.spj\\(Default)",
"HKEY_CURRENT_USER\\rtffile\\Shell\\NCHconvertdoc\\command\\(Default)",
"HKEY_CURRENT_USER\\vocfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\tar.gzfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\vpjfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\apefile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\NCHconvertvideo\\(Default)",
"HKEY_CURRENT_USER\\exrfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.ds2\\(Default)",
"HKEY_CURRENT_USER\\giffile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\NCHconvertimage\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Software\\Installer",
"HKEY_CURRENT_USER\\crwfile\\Shell\\NCHconvertimage\\(Default)",
"HKEY_CURRENT_USER\\erffile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\drpfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHconvertdoc\\(Default)",
"HKEY_CURRENT_USER\\dctfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\vpjfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\dvfile\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\.vpj\\(Default)",
"HKEY_CURRENT_USER\\spjfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\.dct\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\srwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\flacfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\pngfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\divxfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\NCH Software\\Inventoria\\Backup\\Folder",
"HKEY_CURRENT_USER\\.dv\\(Default)",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\.mpeg2\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\mpeg2file\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\NCHeditsound\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\MinutesRunSinceLastInstall",
"HKEY_CURRENT_USER\\srwfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.MOV\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\shnfile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\.drp\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\NCHconvertvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.3GP\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\srwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\.npp\\(Default)",
"HKEY_CURRENT_USER\\dngfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\vocfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.gsm\\(Default)",
"HKEY_CURRENT_USER\\srffile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WAV\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\.caf\\(Default)",
"HKEY_CURRENT_USER\\srffile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\gzfile\\Shell\\NCHextract\\(Default)",
"HKEY_CURRENT_USER\\rw2file\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\NCH Software\\Inventoria\\Settings\\RunsSinceLastInstall",
"HKEY_CURRENT_USER\\.mkv\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.ASF\\Shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\tarfile\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.M4A\\Shell\\NCHeditsound\\command\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.WMA\\Shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\ddpfile\\shell\\open\\command\\(Default)",
"HKEY_CURRENT_USER\\mpdpfile\\(Default)",
"HKEY_CURRENT_USER\\wpsfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\drpfile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\bz2file\\Shell\\NCHextract\\command\\(Default)",
"HKEY_CURRENT_USER\\sr2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\nrwfile\\Shell\\NCHslideshow\\(Default)",
"HKEY_CURRENT_USER\\bz2file\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\.srf\\(Default)",
"HKEY_CURRENT_USER\\WMP11.AssocFile.AIFF\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\gsmfile\\DefaultIcon\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria\\DisplayName",
"HKEY_CURRENT_USER\\.tar.gz\\(Default)",
"HKEY_CURRENT_USER\\jp2file\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\Paint.Picture\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\ds2file\\shell\\NCHconvertsound\\command\\(Default)",
"HKEY_CURRENT_USER\\caffile\\Shell\\NCHconvertsound\\(Default)",
"HKEY_CURRENT_USER\\crwfile\\Shell\\NCHslideshow\\command\\(Default)",
"HKEY_CURRENT_USER\\mkvfile\\Shell\\NCHeditvideo\\command\\(Default)",
"HKEY_CURRENT_USER\\jpegfile\\Shell\\NCHconvertimage\\command\\(Default)",
"HKEY_CURRENT_USER\\.arw\\(Default)",
"HKEY_CURRENT_USER\\.tar\\(Default)",
"HKEY_CURRENT_USER\\FirefoxHTML-E7CF176E110C211B\\shell\\NCHeditvideo\\(Default)",
"HKEY_CURRENT_USER\\.rar\\(Default)"
]
},
"first_seen": 1589064787.312124,
"ppid": 2660
},
{
"process_path": "C:\\Windows\\explorer.exe",
"process_name": "explorer.exe",
"pid": 1788,
"summary": {
"directory_created": [
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer"
],
"dll_loaded": [
"C:\\Windows\\system32\\xmllite.dll",
"CRYPTSP.dll"
],
"file_opened": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\Windows\\System32\\calc.exe",
"c:\\program files (x86)\\internet explorer\\iexplore.exe",
"C:\\",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini",
"c:\\program files (x86)\\nch software\\inventoria\\inventoria.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk",
"c:\\program files (x86)\\mozilla firefox\\firefox.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini",
"C:\\ProgramData",
"C:\\Program Files (x86)\\Mozilla Firefox\\",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows",
"C:\\Users\\cuck\\Desktop\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\Program Files (x86)\\windows media player\\wmplayer.exe",
"C:\\Windows\\explorer.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Firefox.lnk",
"C:\\Windows\\System32\\en-US\\wfsr.dll.mui",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu",
"C:\\Windows\\System32\\snippingtool.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\Users\\Public\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini",
"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools",
"C:\\Windows\\System32\\imageres.dll",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\Windows\\AppPatch\\sysmain.sdb",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\Windows\\System32\\WFS.exe",
"C:\\Windows\\System32\\StikyNot.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini",
"C:\\Program Files (x86)\\nch software\\inventoria\\inventoria.exe",
"C:\\Users\\cuck\\AppData\\Roaming",
"C:\\Program Files (x86)\\windows media player\\en-US\\wmplayer.exe.mui",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Python 2.7",
"C:\\Users\\Public\\Desktop",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db",
"C:\\Program Files (x86)\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk",
"C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk",
"C:\\Users",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db",
"C:\\Windows\\System32\\xpsrchvw.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\Users\\desktop.ini",
"C:\\Windows\\System32\\mspaint.exe",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk",
"C:\\Users\\cuck",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db",
"C:\\Windows\\System32\\SnippingTool.exe",
"C:\\Windows\\System32\\WFSR.dll",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs",
"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\Windows\\System32\\rundll32.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini",
"C:\\Users\\cuck\\AppData",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini",
"C:\\Users\\cuck\\Desktop",
"C:\\Windows\\System32\\en-US\\calc.exe.mui",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games",
"C:\\Windows\\System32\\cmd.exe",
"C:\\Users\\Public",
"C:\\ProgramData\\Microsoft",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini",
"C:\\Windows\\Branding\\ShellBrd\\shellbrd.dll",
"c:\\program files (x86)\\internet explorer\\en-US\\iexplore.exe.mui",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk",
"C:\\Windows\\System32\\displayswitch.exe",
"C:\\Windows\\System32\\mstsc.exe"
],
"regkey_opened": [
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F05C8358C56DAD54BB81D0A11DD52F41",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D0CBB37A94C46943A90AC5008CF1CC9",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0F4DC93AAA8AD1D448BC4E6A207F4FE0",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\895805CC90C04694887EF6BD140A622D",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\BE0BD5097A638224EB0DAAE870267F03",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B06071FE021ECB04E8B3BF1E39AD5BB3",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CDBF699A8F2EAC2438564C3D50E9E638",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5B5C8B2FB95B57147954C18085D53ACE",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\040E2A370D6DB2F45AE45A0032BC2179",
"HKEY_CLASSES_ROOT\\Outlook.Application.12",
"HKEY_CLASSES_ROOT\\Outlook.Application.11",
"HKEY_CLASSES_ROOT\\Outlook.Application.10",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0EF52818FCE3E7B488427C1F8266654E",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\669C9DC1419C0F240B35B36B99AAB50C",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1E82F31DC0D05AA4CB291B7BAA23FC8E",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FBEAAA6C37E8AF24B87AAEA0047433BD",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\103857F24A2EDA54A800A41FA570861F",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D3541DFF9B79C584284E8981624C04CB",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A7E9995902A24964C9C5D461E1C86F19",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\87C48B95924E3294FBC1766C9225DD0C",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E85E64F0A7FC58E47A87E5AB98A6F2DD",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\958C4A0DE6C8D5C428C6E9D875BC33B6",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4486F7CE8F022FB4EB0154C5226C27A0",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B1D5EA6004F809D48B117CE563261011",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\33AB3CD4D27277545B5A93CD4ECB96B4",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5E429E5BC27530F4786481EC687D9EC9",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7FE547D6F0D72534A80F89C4AB727618",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\AE5A0040C41ACA642AF6DB16F4D2F638",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0411990C889EE9B47BB0B5D356564877",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\2FA90A429E82313489DAA2E2C2F0872C",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\75B368B60C908BA4E87C31F66B02F3F0",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5B04950B5EC5C924B8F428B5484A2720",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\89DF671CDA74E9D4EB10275B10D5CF3F",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CB2182A03B6B11341A1F09A021991CE1",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\62293D511DB84E5489074C5AFA18E882",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9D22CD4619F5DBC499A083AAD70FE7B3",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FF9FDEA72CD9DDC47A6DAB85F9F76B81",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7BF7ABF4D25C03F4582D4BC3082FB208",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E40FDF839772BEB41AC977860DBB4853",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CE5B971A0DBB8FD4F83AE0DADC348104",
"HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\LanmanServer\\DefaultSecurity",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CF65AB832507EDB4BB357F9D8E0431BD",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\63B1AF366905AF641BA514CCBAE803C4",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Installer\\Products\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8691BCC36FF121849A90B085BFAF5E5E",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F591EF48DE97A00428A5BC1AFFFAA868",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\Managed\\S-1-5-21-699399860-4089948139-3198924279-1001\\Installer\\Products\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\285499F23409ED14FB4A01230F5DFA91",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9BA984AD4F03E284382FFBB7A68BEE27",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4FE19F224928A59468049F045950CB08",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\84C584688CFC74A4E9D36E5EE2E02FA7",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9F5ED6B416EF0A1448D94799D0FF20BA",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7FEB01D34D0F67E4F9CD810B432C1B91",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4514EC211C8947C4B9BA24F353AFFD50",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\PropertyHandlers\\.lnk",
"HKEY_LOCAL_MACHINE\\Software\\Classes\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4FE462B32EFD81040A184ED17E00452B",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7814D91294731FF4DBBB840810BEB3BB",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\67C12EF40671B7342A2F990919031A57",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B4BBDDC88CEE4DD439E8BB261CE222A8",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\296744B7EBFEB2741A47781AE6E32269",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\92F9143E715DEF045A539256438E41FB",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8020CF43278B2644190F51544810251E",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B690B72A999998C47B5F93C94A8D43B2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\30FAECE2400494D4FB69207288EB5B73",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\16AC40BE991DF1643B2800729063B2F9",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Installer\\Products\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7C0477DE66D1A6749864FCE02A6DCB6C",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Applications\\explorer.exe\\TaskbarExceptionsIcons",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D5FD8239A83FE564F97379EA15CE8CB6",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\04C56B5D827A9194FA2CBFD014EAD0DA",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4626147D107665540A84D43A5908E74D",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A558E619ABC4CE5479C1DA5070EFBF81",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\18D84E9490A485948A17A1F02CDAA62A",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\315C767EFC72D8445B1D2D16F72653F0",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\11E2BA15171FE704B98E7505E58D7749",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D38A6F5FC8262149A9FAAE8C621EE3F",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8ECC347096FA78C4E8291F449F71E16E",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FE056816E41FD2F4CACD03E7A2CA2E6E",
"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ThumbnailCache",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\89BBBC8A0D32B014696C4BA3C20CDD34",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9DD74C0626DC33C479C1929714AB5295",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\95E2C34402A93A14FA8CB3420B85375C",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\53F08364FFD17F14B8FD7CA7F52FAE76",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C1EF68F348457B246A0AD0C18B3079AF",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E116C831A95AB5B4787CE3086FE83631",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\863CA21BBA4DFCE489FDF96EAB898616",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A0256FF64030E0746A4AA95D3FFD0BE4",
"HKEY_CLASSES_ROOT\\Outlook.Application",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StuckRects2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D04063BE69797D4D8505462827A0D19",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FFFA6DF7EA9EDFC45A1F02FE6DF8F067",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\73964AA699D5B5140ADC41ED3F7DB38A",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9753E3A35E3BDFB468DF95B5D19C8A04",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Sharing",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F356843B045CC0A4BA0D83C1D85AAAFD",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D725CB8E57307E64EB574E04214D8B5F",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1C1ED53B8F25FD248955C15232E46886",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1A0857155A8EF604FA5D1648CF382DC7",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\18F5DB38C45303843B06B1B5025E4820",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\3D197E722531D614AB40C182904D9A31",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\AD21E12039BB3BC47B1938BC4ABDFEE2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\034A8F8E06031EF46BCB4C10469098E5",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C4040CC509FB0DC4886F590DDF6B6132",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\84BBAC70FB00B6046881B55CB3122F0F",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F21868A51A175874BB819DCA5FAA40A3",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0A191B45599EEB74CA305184EA3C2A94",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\3C68656E520593A45925ADFB41F821B5",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\90860AAA7BD3DE34EB32330DD29CAD62",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\002F6EFFA8A0A40498F3035BD153685A",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F41A458014D57E54E8DBD0B0CBC361A2",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9E40FDB6330EBA242A4BD5F4FDD0B803",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5E3DAE67887931944BCD7171908FA775",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\965742E8F65116F4BB2CB01341464FA7",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\717591555BCB1604BA9777E8A55D0E41",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\335F6F64CD461D9469519574D34757EB",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\17E23EF6C775D324DB90E0E2B7D1CA72",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0FD387D006FD9734FA65B249F36DE42A",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\95EE473833000D6409127D1B85882AC9",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\EEF8AA9EB45B5DB4BBE46B8634C910CD",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\586A8930D8DF3B6489614C37910BFCF5\\Features",
"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7636A94AA21EDBB48B6AFFB17E5907B8"
],
"regkey_deleted": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupCollapseState",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\ItemOrder",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\ItemPos800x600x96(1)"
],
"file_exists": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\Python27\\pythonw.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\Users\\cuck\\Desktop",
"C:\\Python27\\python.exe",
"C:\\cuckoo_1788.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\Users\\Public",
"C:\\Users",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\Users\\cuck",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ThumbCacheToDelete",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\Users\\Public\\Desktop",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\Program Files (x86)\\NCH Software\\Inventoria",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db"
],
"mutex": [
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwReaderRefs",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_32.db!dfMaintainer",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_256.db!dfMaintainer",
"Local\\Shell.CMruPidlList",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_sr.db!dfMaintainer",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1024.db!dfMaintainer",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!ThumbnailCacheInit",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_96.db!dfMaintainer",
"Global\\C::Users:cuck:AppData:Local:Microsoft:Windows:Explorer:thumbcache_idx.db!rwWriterMutex"
],
"file_failed": [
"C:\\Users\\cuck\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\Microsoft\\desktop.ini",
"C:\\Users\\cuck\\Desktop\\NCH Suite.lnk",
"C:\\cuckoo_1788.ini",
"C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\desktop.ini"
],
"guid": [
"{9b63616c-36b2-46bc-959f-c1593952d19b}",
"{1f3427c8-5c10-4210-aa03-2ee45287d668}",
"{00000323-0000-0000-c000-000000000046}",
"{42aedc87-2188-41fd-b9a3-0c966feabec1}",
"{f676c15d-596a-4ce2-8234-33996f445db1}",
"{49f371e1-8c5c-4d9c-9a3b-54a6827f513c}",
"{a4341687-7593-47aa-9554-4b0ffc8b2214}",
"{00000000-0000-0000-c000-000000000046}",
"{688c934d-0c26-40f6-8d29-d56d72c76b48}",
"{46a6eeff-908e-4dc6-92a6-64be9177b41c}",
"{00000146-0000-0000-c000-000000000046}",
"{76765b11-3f95-4af2-ac9d-ea55d8994f1a}",
"{50ef4544-ac9f-4a8e-b21b-8a26180db13f}",
"{edb5f444-cb8d-445a-a523-ec5ab6ea33c7}",
"{ab8902b4-09ca-4bb6-b78d-a8f59079a8d5}",
"{75121952-e0d0-43e5-9380-1d80483acf72}",
"{660b90c8-73a9-4b58-8cae-355b7f55341b}",
"{2fb499a3-cfce-480f-a5f3-2453db7a2b7a}",
"{1a1f4206-0688-4e7f-be03-d82ec69df9a5}",
"{000214e6-0000-0000-c000-000000000046}"
],
"file_read": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk",
"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk",
"C:\\Users\\Public\\Desktop\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk",
"C:\\Users\\cuck\\Desktop\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk",
"C:\\Users\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Firefox.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\Desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\Desktop.ini",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\desktop.ini",
"C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"C:\\Users\\Public\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini",
"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\Desktop.ini",
"C:\\Program Files (x86)\\desktop.ini",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk"
],
"regkey_read": [
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0A191B45599EEB74CA305184EA3C2A94\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\67C12EF40671B7342A2F990919031A57\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\90860AAA7BD3DE34EB32330DD29CAD62\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\rhqprqvg.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Erzbgr Qrfxgbc Pbaarpgvba.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-699399860-4089948139-3198924279-1001\\ProfileImagePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.VagreargRkcybere.Qrsnhyg",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CF65AB832507EDB4BB357F9D8E0431BD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E85E64F0A7FC58E47A87E5AB98A6F2DD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D04063BE69797D4D8505462827A0D19\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Jvaqbjf Sverjnyy jvgu Nqinaprq Frphevgl.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Znvagranapr\\Erzbgr Nffvfgnapr.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Genafpevcgvba Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\NeverShowExt",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\FXSRESM.dll,-114",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zntavsl.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{NN198O3P-PQ8P-7QR1-98Q1-O460S637193O}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-19\\ProfileImagePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Ivqrb Pncgher Fbsgjner.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Rkcerff Ohea PQ, QIQ be Oyh-Enl.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{4QO6NNNN-156Q-2988-53O4-OP8RS9840SP1}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\DisableProcessIsolation",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{15067OP1-P5N8-425R-37P6-SN0O891674S9}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\863CA21BBA4DFCE489FDF96EAB898616\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1E82F31DC0D05AA4CB291B7BAA23FC8E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B4BBDDC88CEE4DD439E8BB261CE222A8\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{63365327-N214-QO68-7R0O-636O6NPS87S4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClearRecentDocsOnExit",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0411990C889EE9B47BB0B5D356564877\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\Content Type",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider Types\\Type 001\\Name",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D3541DFF9B79C584284E8981624C04CB\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\FavoritesRemovedChanges",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Zngu Vachg Cnary.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jvaqbjf CbjreFuryy\\Jvaqbjf CbjreFuryy VFR.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Taskband\\FavoritesChanges",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{53123611-QN37-S8QN-SNP9-03R76QO9Q64Q}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7BF7ABF4D25C03F4582D4BC3082FB208\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\LanmanServer\\DefaultSecurity\\SrvsvcDefaultShareInfo",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A7E9995902A24964C9C5D461E1C86F19\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8691BCC36FF121849A90B085BFAF5E5E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jvaqbjf CbjreFuryy\\Jvaqbjf CbjreFuryy (k86).yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Jvaqbjf Snk naq Fpna.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemFolderNameDisplay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FE056816E41FD2F4CACD03E7A2CA2E6E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.TrggvatFgnegrq",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\FavccvatGbby.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_LargeMFUIcons",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flap Pragre.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\qsethv.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\ArgjbexCebwrpgvba.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\103857F24A2EDA54A800A41FA570861F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{P1P6S8NP-40N3-0S5P-146S-65N9QP70OOO4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\{9113A02D-00A3-46B9-BC5F-9C04DADDD5D7}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\AE5A0040C41ACA642AF6DB16F4D2F638\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\freivprf.zfp",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Taskband\\FavoritesRemovedChanges",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\StartMenu_Balloon_Time",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{551R32Q6-S1Q9-Q5SP-334P-3728R154N349}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseInProcHandlerCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1F3427C8-5C10-4210-AA03-2EE45287D668}\\InProcServer32\\LoadWithoutCOM",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\95E2C34402A93A14FA8CB3420B85375C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7FEB01D34D0F67E4F9CD810B432C1B91\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\{b155bdf8-02f0-451e-9a26-ae317cfd7779}\\SuppressionPolicy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{N4P35507-1P2S-1P25-2NO6-54NS1P5196P3}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FF9FDEA72CD9DDC47A6DAB85F9F76B81\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU Size",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{S84090O0-S544-1NRN-246O-S1Q0Q906OQ9Q}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Pnyphyngbe.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{67SO9SQ4-4776-616P-S27S-5PS35769Q9Q8}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Qvfx Pyrnahc.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\296744B7EBFEB2741A47781AE6E32269\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.FgvpxlAbgrf",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.ZrqvnCynlre32",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Jvaqbjf Rkcybere.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\62293D511DB84E5489074C5AFA18E882\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7636A94AA21EDBB48B6AFFB17E5907B8\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\\GnfxOne\\Jvaqbjf Rkcybere.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Gnoyrg CP\\FuncrPbyyrpgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8ECC347096FA78C4E8291F449F71E16E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\IsShortcut",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Jvaqbjf CbjreFuryy Zbqhyrf.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{OQ3S924R-55SO-N1ON-9QR6-O50S9S2460NP}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5E429E5BC27530F4786481EC687D9EC9\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9BA984AD4F03E284382FFBB7A68BEE27\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\89DF671CDA74E9D4EB10275B10D5CF3F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zfcnvag.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Gnoyrg CP\\Jvaqbjf Wbheany.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\AlwaysShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pnyp.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jvaqbjf CbjreFuryy\\Jvaqbjf CbjreFuryy VFR (k86).yax",
"HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\MUI\\StringCacheSettings\\StringCacheGeneration",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{NQ9N4QRQ-047Q-NQ20-93Q4-97567333Q0PP}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Znvagranapr\\Perngr Erpbirel Qvfp.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\895805CC90C04694887EF6BD140A622D\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zfen.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemPathDisplay",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{S38OS404-1Q43-42S2-9305-67QR0O28SP23}\\rkcybere.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\\GnfxOne\\Jvaqbjf Zrqvn Cynlre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\89BBBC8A0D32B014696C4BA3C20CDD34\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Jvaqbjf Nalgvzr Hctenqr.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4626147D107665540A84D43A5908E74D\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\586A8930D8DF3B6489614C37910BFCF5\\Features\\DefaultFeature",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Fvqrone.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_MinMFU",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Flfgrz Gbbyf\\Cevingr Punenpgre Rqvgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4486F7CE8F022FB4EB0154C5226C27A0\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Vagrearg Rkcybere.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\qsethv.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F05C8358C56DAD54BB81D0A11DD52F41\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{ED228FDF-9EA8-4870-83B1-96B02CFE0D52}\\SortOrderIndex",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zboflap.rkr",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\SNTSearch.dll,-505",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Crefbany Svanapr Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9D22CD4619F5DBC499A083AAD70FE7B3\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9DD74C0626DC33C479C1929714AB5295\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackProgs",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\FbhaqErpbeqre.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-20\\ProfileImagePath",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\002F6EFFA8A0A40498F3035BD153685A\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\efgehv.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Pbzzba Svyrf\\Zvpebfbsg Funerq\\Vax\\zvc.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\717591555BCB1604BA9777E8A55D0E41\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\vFPFV Vavgvngbe.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\bqopnq32.rkr",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\displayswitch.exe,-320",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemNameDisplay",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_MinMFU",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9753E3A35E3BDFB468DF95B5D19C8A04\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\R7PS176R110P211O",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemPathDisplayNarrow",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{Q4N262QQ-PR44-Q105-S36O-9Q77N8PO65N4}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5\\DefaultFeature",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\Content Type",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\AlwaysShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\\APU Fbsgjner\\Vairagbevn\\vairagbevn.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4FE462B32EFD81040A184ED17E00452B\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\JnirCnq Fbhaq Rqvgbe.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Erfbhepr Zbavgbe.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\KCF Ivrjre.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\\GnfxOne\\Vagrearg Rkcybere.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Jvaqbjf Zrqvn Cynlre.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jbeqcnq.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4514EC211C8947C4B9BA24F353AFFD50\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached\\{1F3427C8-5C10-4210-AA03-2EE45287D668} {000214E6-0000-0000-C000-000000000046} 0xFFFF",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8020CF43278B2644190F51544810251E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Vairagbel Fbsgjner.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Zrqvn Pragre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A0256FF64030E0746A4AA95D3FFD0BE4\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C4040CC509FB0DC4886F590DDF6B6132\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Sharing\\UsersShareName",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\BrowseInPlace",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0EF52818FCE3E7B488427C1F8266654E\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7C0477DE66D1A6749864FCE02A6DCB6C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\{35786D3C-B075-49b9-88DD-029876E11C01}\\SuppressionPolicy",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0F4DC93AAA8AD1D448BC4E6A207F4FE0\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\erpqvfp.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\P:\\Clguba27\\clguba.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\EnableShareDenyNone",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D725CB8E57307E64EB574E04214D8B5F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\QIQ Znxre\\QIQZnxre.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DefaultIcon\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Punenpgre Znc.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CE5B971A0DBB8FD4F83AE0DADC348104\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemFolderPathDisplay",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\IsShortcut",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.VagreargRkcybere.64Ovg",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Rirag Ivrjre.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Gnoyrg CP\\GnoGvc.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\P:\\Hfref\\Choyvp\\Qrfxgbc\\Vairagbevn Fgbpx Znantre.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\FavoritesRemovedChanges",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{9R3995NO-1S9P-4S13-O827-48O24O6P7174}\\GnfxOne\\Sversbk.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Qngn Fbheprf (BQOP).yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\315C767EFC72D8445B1D2D16F72653F0\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{7SR8Q22N-SO1Q-N8OR-01R3-6P8693961R6R}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\3D197E722531D614AB40C182904D9A31\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Pbzzba Svyrf\\Zvpebfbsg Funerq\\Vax\\FuncrPbyyrpgbe.rkr",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\mstsc.exe,-4000",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\958C4A0DE6C8D5C428C6E9D875BC33B6\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Clguba 2.7\\Clguba (pbzznaq yvar).yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.FileName",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jrypbzr Pragre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.ItemFolderPathDisplayNarrow",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{83283PQ6-PO09-7R70-QQN4-Q81112QN721O}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1A0857155A8EF604FA5D1648CF382DC7\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\NodeSlots",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Sversbk.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Fjvgpu Fbhaq Svyr Pbairegre.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Pbzcbarag Freivprf.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JS.zfp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\17E23EF6C775D324DB90E0E2B7D1CA72\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Pbzzba Svyrf\\Zvpebfbsg Funerq\\Vax\\GnoGvc.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\\Type",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Nppbhagvat Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\AlwaysShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_NotifyNewApps",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\NodeSlot",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\63B1AF366905AF641BA514CCBAE803C4\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B06071FE021ECB04E8B3BF1E39AD5BB3\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Gnfx Fpurqhyre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\84BBAC70FB00B6046881B55CB3122F0F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Vagrearg Rkcybere (64-ovg).yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\freivprf.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1F3427C8-5C10-4210-AA03-2EE45287D668}\\InProcServer32\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Fgvpxl Abgrf.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JSF.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\040E2A370D6DB2F45AE45A0032BC2179\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5B04950B5EC5C924B8F428B5484A2720\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pzq.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{772S366N-R591-9RR1-P344-S9543725R2QS}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E40FDF839772BEB41AC977860DBB4853\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Cnvag.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Vaibvpvat Fbsgjner.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Npprffvovyvgl\\Fcrrpu Erpbtavgvba.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\CLSID\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\ArgCebw.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FBEAAA6C37E8AF24B87AAEA0047433BD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Abgrcnq.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\84C584688CFC74A4E9D36E5EE2E02FA7\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Cresbeznapr Zbavgbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\53F08364FFD17F14B8FD7CA7F52FAE76\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{58O262P2-RS93-O688-750O-2P8RPQ84452R}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfNalgvzrHctenqrHV.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\ZvkCnq ZhygvGenpx Zvkre.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Frphevgl Pbasvthengvba Znantrzrag.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\bfx.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Fbhaq Erpbeqre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\285499F23409ED14FB4A01230F5DFA91\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.ErzbgrQrfxgbc",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_TrackProgs",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\{28636AA6-953D-11D2-B5D6-00C04FD918D0} 6",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Jvaqbjf Rnfl Genafsre Ercbegf.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_LargeMFUIcons",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.IsPinnedToNameSpaceTree",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9F5ED6B416EF0A1448D94799D0FF20BA\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Flfgrz Pbasvthengvba.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\04C56B5D827A9194FA2CBFD014EAD0DA\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\puneznc.rkr",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\PromotedIconCache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\abgrcnq.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\qvfcynlfjvgpu.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\034A8F8E06031EF46BCB4C10469098E5\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\NoOplock",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PropertySystem\\PropertyHandlers\\.lnk\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Favccvat Gbby.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{P804OON7-SN5S-POS7-8O55-2096R5S972PO}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zvtjvm\\cbfgzvt.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Cevag Znantrzrag.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Flfgrz Erfgber.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F356843B045CC0A4BA0D83C1D85AAAFD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\System.NamespaceCLSID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Npprffvovyvgl\\Zntavsl.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\C1EF68F348457B246A0AD0C18B3079AF\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Jvaqbjf Wbheany\\Wbheany.rkr",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\SnippingTool.exe,-15051",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\FavoritesChanges",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F591EF48DE97A00428A5BC1AFFFAA868\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\4FE19F224928A59468049F045950CB08\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\669C9DC1419C0F240B35B36B99AAB50C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.IconPath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\kcfepuij.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\2FA90A429E82313489DAA2E2C2F0872C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Pbzznaq Cebzcg.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Directory\\DocObject",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\aneengbe.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{8NN47365-O2O3-1961-69RO-S866R376O12S}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\87C48B95924E3294FBC1766C9225DD0C\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\92F9143E715DEF045A539256438E41FB\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Clguba 2.7\\Zbqhyr Qbpf.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.Jvaqbjf.ZrqvnPragre",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Gnfx Fpurqhyre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B1D5EA6004F809D48B117CE563261011\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\335F6F64CD461D9469519574D34757EB\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\\JvaqbjfCbjreFuryy\\i1.0\\cbjrefuryy.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Cache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zfvasb32.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F41A458014D57E54E8DBD0B0CBC361A2\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\ZqFpurq.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\shellex\\IconHandler\\(Default)",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{8NOQ94SO-R7Q6-84N6-N997-P918RQQR0NR5}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\cevagznantrzrag.zfp",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7814D91294731FF4DBBB840810BEB3BB\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\OobeFldr.dll,-33056",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\7FE547D6F0D72534A80F89C4AB727618\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\B690B72A999998C47B5F93C94A8D43B2\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\33AB3CD4D27277545B5A93CD4ECB96B4\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Vairagbevn Fgbpx Znantre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\DelegateFolders\\SuppressionPolicy",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{QNN168QR-4306-P8OP-8P11-O596240OQQRQ}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{37N86N0O-5OR8-360N-8O0S-91579OQS2ROO}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.SFGAOFlags",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D0CBB37A94C46943A90AC5008CF1CC9\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Vaibvpvat Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\D5FD8239A83FE564F97379EA15CE8CB6\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\JvaqbjfCbjreFuryy\\i1.0\\CbjreFuryy_VFR.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Npprffvovyvgl\\Aneengbe.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\OverrideFileSystemProperties\\System.Kind",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\ehome\\ehres.dll,-100",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{Q65231O0-O2S1-4857-N4PR-N8R7P6RN7Q27}\\JvaqbjfCbjreFuryy\\i1.0\\CbjreFuryy_VFR.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{6Q809377-6NS0-444O-8957-N3773S02200R}\\Jvaqbjf AG\\Npprffbevrf\\jbeqcnq.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\0FD387D006FD9734FA65B249F36DE42A\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\P:\\Hfref\\Choyvp\\Qrfxgbc\\APU Fhvgr.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{OO044OSQ-25O7-2SNN-22N8-6371N93R0456}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\E116C831A95AB5B4787CE3086FE83631\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\FFFA6DF7EA9EDFC45A1F02FE6DF8F067\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\8D38A6F5FC8262149A9FAAE8C621EE3F\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\A558E619ABC4CE5479C1DA5070EFBF81\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Installer\\Features\\586A8930D8DF3B6489614C37910BFCF5\\TclTk",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\95EE473833000D6409127D1B85882AC9\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Products\\586A8930D8DF3B6489614C37910BFCF5\\Features\\TclTk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Zbovyvgl Pragre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\965742E8F65116F4BB2CB01341464FA7\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\73964AA699D5B5140ADC41ED3F7DB38A\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pyrnazte.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\StartMenu_Balloon_Time",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Start_NotifyNewApps",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Jvaqbjf CbjreFuryy\\Jvaqbjf CbjreFuryy.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{N77S5Q77-2R2O-44P3-N6N2-NON601054N51}\\Npprffbevrf\\Npprffvovyvgl\\Ba-Fperra Xrlobneq.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.lnk\\ShellEx\\{000214F9-0000-0000-C000-000000000046}\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-18\\ProfileImagePath",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Pbzchgre Znantrzrag.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\qvfcynlfjvgpu.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\EEF8AA9EB45B5DB4BBE46B8634C910CD\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\IvqrbCnq Ivqrb Rqvgbe.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Jvaqbjf Rnfl Genafsre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\AD21E12039BB3BC47B1938BC4ABDFEE2\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Cevfz Ivqrb Svyr Sbezng Pbairegre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\18F5DB38C45303843B06B1B5025E4820\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\BE0BD5097A638224EB0DAAE870267F03\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Clguba 2.7\\VQYR (Clguba THV).yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5E3DAE67887931944BCD7171908FA775\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CDBF699A8F2EAC2438564C3D50E9E638\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@\"%windir%\\System32\\ie4uinit.exe\",-732",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\APU Fbsgjner Fhvgr\\Nppbhagvat Fbsgjner.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.lnk\\DocObject",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{8N737966-4Q0N-OR34-73OQ-410009188R91}",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Nqzvavfgengvir Gbbyf\\Zrzbel Qvntabfgvpf Gbby.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\vfpfvpcy.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\9E40FDB6330EBA242A4BD5F4FDD0B803\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\lnkfile\\NeverShowExt",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\MRUListEx",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Npprffbevrf\\Flfgrz Gbbyf\\Flfgrz Vasbezngvba.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{00021401-0000-0000-C000-000000000046}\\UseOutOfProcHandlerCache",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.exe\\(Default)",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\16AC40BE991DF1643B2800729063B2F9\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\1C1ED53B8F25FD248955C15232E46886\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zvtjvm\\zvtjvm.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\30FAECE2400494D4FB69207288EB5B73\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Ohfvarff Eryngrq Cebtenzf\\Ergnvy CBF cbvag bs fnyr fbsgjner flfgrz.yax",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\zfpbasvt.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{F4E57C4B-2036-45F0-A9AB-443BCFE33D9F}\\Count\\{0139Q44R-6NSR-49S2-8690-3QNSPNR6SSO8}\\Jvaqbjf QIQ Znxre.yax",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\CB2182A03B6B11341A1F09A021991CE1\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\F21868A51A175874BB819DCA5FAA40A3\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\IsShortcut",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SQMClient\\Windows\\CEIPEnable",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\Defaults\\Provider\\Microsoft Strong Cryptographic Provider\\Image Path",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\@C:\\Windows\\system32\\XpsRchVw.exe,-102",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\P:\\Hfref\\phpx\\NccQngn\\Ybpny\\Grzc\\a1f\\apufrghc.rkr",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\5B5C8B2FB95B57147954C18085D53ACE\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\18D84E9490A485948A17A1F02CDAA62A\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\11E2BA15171FE704B98E7505E58D7749\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\3C68656E520593A45925ADFB41F821B5\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\Zvpebfbsg.NhgbTrarengrq.{201P5SO7-0429-89S6-963Q-8QR3N1POO2NR}",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\exefile\\DocObject",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\SystemFileAssociations\\.exe\\NeverShowExt",
"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\S-1-5-18\\Components\\75B368B60C908BA4E87C31F66B02F3F0\\586A8930D8DF3B6489614C37910BFCF5",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pbzrkc.zfp"
],
"regkey_written": [
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\\APU Fbsgjner\\Vairagbevn\\vairagbevn.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupView",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupByKey:FMTID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\IconSize",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\FFlags",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\MRUListEx",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\Sort",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\IconStreams",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\ColInfo",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\HRZR_PGYFRFFVBA",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2\\ProgramsCache",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupByDirection",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"HKEY_CURRENT_USER\\Local Settings\\MuiCache\\2\\52C64B7E\\LanguageList",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\PastIconsStream",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\BagMRU\\NodeSlots",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\LastAdvertisement",
"HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\UserStartTime",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\GroupByKey:PID",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\P:\\Hfref\\phpx\\NccQngn\\Ybpny\\Grzc\\a1f\\apufrghc.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StuckRects2\\Settings",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\LogicalViewMode",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop\\Mode",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist\\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\\Count\\{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\\pzq.rkr",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Streams\\Desktop\\TaskbarWinXP",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage\\NewShortcuts\\C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk"
]
},
"first_seen": 1589064789.265249,
"ppid": 1740
}
]Signatures
[
{
"markcount": 22,
"families": [],
"description": "Queries for the computername",
"severity": 1,
"marks": [
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064789.078124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 2156
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064789.203124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 3268
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064789.218124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 3394
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064789.765124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 6180
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064789.843124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 6332
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064789.859124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 6484
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064789.953124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 6636
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064790.937124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 6791
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.328124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 6955
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.343124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 7107
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.468124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 7259
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.640124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 7411
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.703124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 7563
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.718124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 7715
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.734124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 7867
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.734124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 8019
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.750124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 8171
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064791.765124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 8323
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064794.375124,
"tid": 2872,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 9205
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064794.921124,
"tid": 2872,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 9277
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064361.64352,
"tid": 2808,
"flags": {}
},
"pid": 1788,
"type": "call",
"cid": 1999
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetComputerNameW",
"return_value": 1,
"arguments": {
"computer_name": "CUCKPC"
},
"time": 1589064361.72152,
"tid": 2808,
"flags": {}
},
"pid": 1788,
"type": "call",
"cid": 2112
}
],
"references": [],
"name": "antivm_queries_computername"
},
{
"markcount": 1,
"families": [],
"description": "Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate)",
"severity": 1,
"marks": [
{
"category": "registry",
"ioc": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "recon_fingerprint"
},
{
"markcount": 1,
"families": [],
"description": "Tries to locate where the browsers are installed",
"severity": 1,
"marks": [
{
"category": "file",
"ioc": "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "locates_browser"
},
{
"markcount": 1,
"families": [],
"description": "The file contains an unknown PE resource name possibly indicative of a packer",
"severity": 1,
"marks": [
{
"category": "resource name",
"ioc": "None",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "pe_unknown_resource_name"
},
{
"markcount": 1,
"families": [],
"description": "Allocates read-write-execute memory (usually to unpack itself)",
"severity": 2,
"marks": [
{
"call": {
"category": "process",
"status": 1,
"stacktrace": [],
"api": "NtAllocateVirtualMemory",
"return_value": 0,
"arguments": {
"process_identifier": 1676,
"region_size": 4096,
"stack_dep_bypass": 0,
"stack_pivoted": 0,
"heap_dep_bypass": 0,
"protection": 64,
"process_handle": "0xffffffff",
"allocation_type": 4096,
"base_address": "0x009e0000"
},
"time": 1589064787.437124,
"tid": 2872,
"flags": {
"protection": "PAGE_EXECUTE_READWRITE",
"allocation_type": "MEM_COMMIT"
}
},
"pid": 1676,
"type": "call",
"cid": 252
}
],
"references": [],
"name": "allocates_rwx"
},
{
"markcount": 0,
"families": [],
"description": "Checks whether any human activity is being performed by constantly checking whether the foreground window changed",
"severity": 2,
"marks": [],
"references": [
"https:\/\/www.virusbtn.com\/virusbulletin\/archive\/2015\/09\/vb201509-custom-packer.dkb"
],
"name": "antisandbox_foregroundwindows"
},
{
"markcount": 2,
"families": [],
"description": "Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation",
"severity": 2,
"marks": [
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer",
"free_bytes_available": 23512158208,
"total_number_of_free_bytes": 0,
"total_number_of_bytes": 0
},
"time": 1589064368.95652,
"tid": 2808,
"flags": {}
},
"pid": 1788,
"type": "call",
"cid": 13739
},
{
"call": {
"category": "misc",
"status": 1,
"stacktrace": [],
"api": "GetDiskFreeSpaceExW",
"return_value": 1,
"arguments": {
"root_path": "C:\\Users\\cuck\\AppData\\Local\\Microsoft\\Windows\\Explorer",
"free_bytes_available": 23512158208,
"total_number_of_free_bytes": 0,
"total_number_of_bytes": 0
},
"time": 1589064369.44052,
"tid": 2360,
"flags": {}
},
"pid": 1788,
"type": "call",
"cid": 14861
}
],
"references": [],
"name": "antivm_disk_size"
},
{
"markcount": 37,
"families": [],
"description": "Creates a shortcut to an executable file",
"severity": 2,
"marks": [
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Video Capture Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\Public\\Desktop\\NCH Suite.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Welcome Center.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Personal Finance Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\MixPad MultiTrack Mixer.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\Public\\Desktop\\Inventoria Stock Manager.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Inventory Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Paint.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Switch Sound File Converter.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\Desktop\\NCH Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\displayswitch.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Snipping Tool.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\WavePad Sound Editor.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Inventoria Stock Manager.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Calculator.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Windows Fax and Scan.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\Public\\Desktop\\NCH Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Invoicing Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Firefox.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Remote Desktop Connection.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Accounting Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\Favorites\\NCH Software Download Site.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\XPS Viewer.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Command Prompt.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Prism Video File Format Converter.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Transcription Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\Desktop\\Inventoria Stock Manager.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Express Burn CD, DVD or Blu-Ray.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\Accounting Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\Desktop\\NCH Suite.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\NCH Software Suite\\VideoPad Video Editor.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Invoicing Software.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Business Related Programs\\Retail POS point of sale software system.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Sticky Notes.lnk",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "creates_shortcut"
},
{
"markcount": 1,
"families": [],
"description": "Drops a binary and executes it",
"severity": 2,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "dropper"
},
{
"markcount": 1,
"families": [],
"description": "Drops an executable to the user AppData folder",
"severity": 2,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "exe_appdata"
},
{
"markcount": 2,
"families": [],
"description": "The binary likely contains encrypted or compressed data indicative of a packer",
"severity": 2,
"marks": [
{
"entropy": 7.997603798784513,
"section": {
"size_of_data": "0x000a0800",
"virtual_address": "0x00004000",
"entropy": 7.997603798784513,
"name": ".rsrc",
"virtual_size": "0x000a07f0"
},
"type": "generic",
"description": "A section with a high entropy has been found"
},
{
"entropy": 0.9915057915057915,
"type": "generic",
"description": "Overall entropy of this PE file is high"
}
],
"references": [
"http:\/\/www.forensickb.com\/2013\/03\/file-entropy-explained.html",
"http:\/\/virii.es\/U\/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf"
],
"name": "packer_entropy"
},
{
"markcount": 1,
"families": [],
"description": "Queries for potentially installed applications",
"severity": 2,
"marks": [
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "RegOpenKeyExW",
"return_value": 0,
"arguments": {
"access": "0x00000001",
"base_handle": "0x80000002",
"key_handle": "0x00000a10",
"regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria",
"regkey_r": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Inventoria",
"options": 0
},
"time": 1589064792.218124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 9061
}
],
"references": [],
"name": "queries_programs"
},
{
"markcount": 1,
"families": [],
"description": "Installs itself for autorun at Windows startup",
"severity": 3,
"marks": [
{
"type": "generic",
"reg_key": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\InventoriaInstall",
"reg_value": "C:\\Users\\cuck\\AppData\\Local\\Temp\\c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1.bin"
}
],
"references": [],
"name": "persistence_autorun"
},
{
"markcount": 2,
"families": [],
"description": "Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config",
"severity": 3,
"marks": [
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "NtSetValueKey",
"return_value": 0,
"arguments": {
"index": 0,
"key_handle": "0x0000000000000f84",
"value": "\u0014\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0010\u0000\u0000\u0000\u0014\u0000\u0000\u0000IL \u0006\u0010\u0000$\u0000\u0018\u0000\u0010\u0000\u0010\u0000\u00ff\u00ff\u00ff\u00ff!\u0010\u00ff\u00ff\u00ff\u00ff\u00ff\u00ff\u00ff\u00ffBM6\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0000\u0000\u0000(\u0000\u0000\u0000\u0010\u0000\u0000\u0000@\u0002\u0000\u0000\u0001\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0090\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"reg_type": 3,
"regkey": "HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\PastIconsStream"
},
"time": 1589064368.37852,
"tid": 1828,
"flags": {
"reg_type": "REG_BINARY"
}
},
"pid": 1788,
"type": "call",
"cid": 13038
},
{
"call": {
"category": "registry",
"status": 1,
"stacktrace": [],
"api": "NtSetValueKey",
"return_value": 0,
"arguments": {
"index": 0,
"key_handle": "0x00000000000001e0",
"value": "\u0014\u0000\u0000\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0014\u0000\u0000\u0000{\u0000S\u00003\u00008\u0000O\u0000S\u00004\u00000\u00004\u0000-\u00001\u0000Q\u00004\u00003\u0000-\u00004\u00002\u0000S\u00002\u0000-\u00009\u00003\u00000\u00005\u0000-\u00006\u00007\u0000Q\u0000R\u00000\u0000O\u00002\u00008\u0000S\u0000P\u00002\u00003\u0000}\u0000\\\u0000r\u0000k\u0000c\u0000y\u0000b\u0000e\u0000r\u0000e\u0000.\u0000r\u0000k\u0000r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u00e4\u0007\u0005\u0000F\u0000b\u0000y\u0000i\u0000r\u0000 \u0000C\u0000P\u0000 \u0000v\u0000f\u0000f\u0000h\u0000r\u0000f\u0000:\u0000 \u00001\u0000 \u0000z\u0000r\u0000f\u0000f\u0000n\u0000t\u0000r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000e\u0000\u0000\u0000v\u00ae x\u00e3#)B\u0082\u00c1\u00e4\u001c\u00b6}[\u009c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00b3\u0086;4\u00e6\u00ee\u00d4\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\r !\u008f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000{\u0000S\u00003\u00008\u0000O\u0000S\u00004\u00000\u00004\u0000-\u00001\u0000Q\u00004\u00003\u0000-\u00004\u00002\u0000S\u00002\u0000-\u00009\u00003\u00000\u00005\u0000-\u00006\u00007\u0000Q\u0000R\u00000\u0000O\u00002\u00008\u0000S\u0000P\u00002\u00003\u0000}\u0000\\\u0000r\u0000k\u0000c\u0000y\u0000b\u0000e\u0000r\u0000e\u0000.\u0000r\u0000k\u0000r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000d\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u00e4\u0007\u0005\u0000F\u0000c\u0000r\u0000n\u0000x\u0000r\u0000e\u0000f\u0000:\u0000 \u00006\u00007\u0000%\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000f\u0000\u0000\u0000s\u00ae x\u00e3#)B\u0082\u00c1\u00e4\u001c\u00b6}[\u009c\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0086\u00e2\u009e\u00956\u0005\u00d4\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\r !\u008f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0000\u0000{\u0000S\u00003\u00008\u0000O\u0000S\u00004\u00000\u00004\u0000-\u00001\u0000Q\u00004\u00003\u0000-\u00004\u00002\u0000S\u00002\u0000-\u00009\u00003\u00000\u00005\u0000-\u00006\u00007\u0000Q\u0000R\u00000\u0000O\u00002\u00008\u0000S\u0000P\u00002\u00003\u0000}\u0000\\\u0000r\u0000k\u0000c\u0000y\u0000b\u0000e\u0000r\u0000e\u0000.\u0000r\u0000k\u0000r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000}\u00c0\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u00e4\u0007\u0005\u0000H\u0000a\u0000v\u0000q\u0000r\u0000a\u0000g\u0000v\u0000s\u0000v\u0000r\u0000q\u0000 \u0000a\u0000r\u0000g\u0000j\u0000b\u0000e\u0000x\u0000 \u0000A\u0000b\u0000 \u0000V\u0000a\u0000g\u0000r\u0000e\u0000a\u0000r\u0000g\u0000 \u0000n\u0000p\u0000p\u0000r\u0000f\u0000f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000",
"reg_type": 3,
"regkey": "HKEY_CURRENT_USER\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\TrayNotify\\IconStreams"
},
"time": 1589064368.37852,
"tid": 1828,
"flags": {
"reg_type": "REG_BINARY"
}
},
"pid": 1788,
"type": "call",
"cid": 13040
}
],
"references": [],
"name": "creates_largekey"
},
{
"markcount": 1,
"families": [],
"description": "Created a service where a service was also not started",
"severity": 3,
"marks": [
{
"call": {
"category": "services",
"status": 1,
"stacktrace": [],
"api": "CreateServiceW",
"return_value": 10876272,
"arguments": {
"service_start_name": "",
"start_type": 3,
"service_handle": "0x00a5f570",
"display_name": "Inventoria Stock Manager",
"error_control": 0,
"service_name": "InventoriaService",
"filepath": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\\"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe\" -service",
"filepath_r": "\"C:\\Program Files (x86)\\NCH Software\\Inventoria\\inventoria.exe\" -service",
"service_manager_handle": "0x00a5f598",
"desired_access": 983551,
"service_type": 16,
"password": ""
},
"time": 1589064789.312124,
"tid": 1616,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 3483
}
],
"references": [],
"name": "creates_service"
},
{
"markcount": 3,
"families": [],
"description": "Deletes executed files from disk",
"severity": 3,
"marks": [
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchsetup.exe",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "C:\\Users\\cuck\\AppData\\Local\\Temp\\n1s\\nchdata.dat",
"type": "ioc",
"description": null
},
{
"category": "file",
"ioc": "",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "deletes_executed_files"
},
{
"markcount": 1,
"families": [],
"description": "Expresses interest in specific running processes",
"severity": 3,
"marks": [
{
"category": "process: potential process injection target",
"ioc": "explorer.exe",
"type": "ioc",
"description": null
}
],
"references": [],
"name": "process_interest"
},
{
"markcount": 1,
"families": [],
"description": "Detects the presence of Wine emulator",
"severity": 3,
"marks": [
{
"call": {
"category": "system",
"status": 0,
"stacktrace": [],
"last_error": 0,
"nt_status": -1073741772,
"api": "LdrGetProcedureAddress",
"return_value": 3221225785,
"arguments": {
"ordinal": 0,
"module": "kernel32",
"module_address": "0x75bb0000",
"function_address": "0x005235e0",
"function_name": "wine_get_unix_file_name"
},
"time": 1589064787.406124,
"tid": 2872,
"flags": {}
},
"pid": 1676,
"type": "call",
"cid": 143
}
],
"references": [],
"name": "antiemu_wine"
}
]Yara
The Yara rules did not detect anything in the file.
Network
{
"tls": [],
"udp": [
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 546,
"time": 3.1122350692749023,
"dport": 137,
"sport": 137
},
{
"src": "192.168.56.101",
"dst": "192.168.56.255",
"offset": 5226,
"time": 9.253465175628662,
"dport": 138,
"sport": 138
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7070,
"time": 3.038753032684326,
"dport": 5355,
"sport": 51001
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7398,
"time": 1.0690782070159912,
"dport": 5355,
"sport": 53595
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 7726,
"time": 3.046549081802368,
"dport": 5355,
"sport": 53848
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8054,
"time": 1.0802061557769775,
"dport": 5355,
"sport": 54255
},
{
"src": "192.168.56.101",
"dst": "224.0.0.252",
"offset": 8382,
"time": -0.06634783744812012,
"dport": 5355,
"sport": 55314
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 8710,
"time": 1.6556501388549805,
"dport": 1900,
"sport": 1900
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 28120,
"time": 1.151987075805664,
"dport": 3702,
"sport": 49152
},
{
"src": "192.168.56.101",
"dst": "239.255.255.250",
"offset": 36504,
"time": 3.1432809829711914,
"dport": 1900,
"sport": 54258
}
],
"dns_servers": [],
"http": [],
"icmp": [],
"smtp": [],
"tcp": [],
"smtp_ex": [],
"mitm": [],
"hosts": [],
"pcap_sha256": "c2519ba30f20e58061b432493ffbf13f738f49d5264c49e8703b382557941373",
"dns": [],
"http_ex": [],
"domains": [],
"dead_hosts": [],
"sorted_pcap_sha256": "ab9d6eb9ed69e199d944887489ee4003ab96e71fba0ca4d55ae6d7f14058a3f9",
"irc": [],
"https_ex": []
}Screenshots
Hashes [?]
| Property | Value |
|---|---|
| MD5 | 890fd7a34f03656ef05b1d4ee1c478e4 |
| SHA256 | c0f8a34c5eec8dc236b8c31dd02a11a26ecc30e3b442329622129bc6c9a336f1 |
Error Messages
These are some of the error messages that can appear related to invsetup.exe:
invsetup.exe has encountered a problem and needs to close. We are sorry for the inconvenience.
invsetup.exe - Application Error. The instruction at "0xXXXXXXXX" referenced memory at "0xXXXXXXXX". The memory could not be "read/written". Click on OK to terminate the program.
Inventoria Stock Manager has stopped working.
End Program - invsetup.exe. This program is not responding.
invsetup.exe is not a valid Win32 application.
invsetup.exe - Application Error. The application failed to initialize properly (0xXXXXXXXX). Click OK to terminate the application.
What will you do with invsetup.exe?
To help other users, please let us know what you will do with invsetup.exe:
Malware or legitimate?
If you feel that you need more information to determine if your should keep this file or remove it, please read this guide.
And now some shameless self promotion ;)
Hi, my name is Roger Karlsson. I've been running this website since 2006. I want to let you know about the FreeFixer program. FreeFixer is a freeware tool that analyzes your system and let you manually identify unwanted programs. Once you've identified some malware files, FreeFixer is pretty good at removing them. You can download FreeFixer here. It runs on Windows 2000/XP/2003/2008/2016/2019/Vista/7/8/8.1/10. Supports both 32- and 64-bit Windows.
If you have questions, feedback on FreeFixer or the freefixer.com website, need help analyzing FreeFixer's scan result or just want to say hello, please contact me. You can find my email address at the contact page.
Comments
Please share with the other users what you think about this file. What does this file do? Is it legitimate or something that your computer is better without? Do you know how it was installed on your system? Did you install it yourself or did it come bundled with some other software? Is it running smoothly or do you get some error message? Any information that will help to document this file is welcome. Thank you for your contributions.
I'm reading all new comments so don't hesitate to post a question about the file. If I don't have the answer perhaps another user can help you.
No comments posted yet.