updated version

first try winlogon.exe pid, updated pids retrieve, removed winreg part