Registry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows

This value contains a space and comma separated list of DLLs to be loaded (»injected«) into applications that are linked with user32.dll.

When User32.dll receives a DLL_PROCESS_ATTACH, it loads the DLLs with LoadLibrary().

Such an injected DLL might be used for API hooking.

Thus, it is a preferred target for malware.

Device stores the name of the default printer.

Part of the name seems to be referenced in a value under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices.

The value of GDIProcessHandleQuota limits the number of GDI object handles per session.

The value of USERProcessHandleQuota limits the number of user object handles per session.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion