Pastein: HKEY_CLASSES_ROOT\AppUserModelId\Windows.Defender.MpUxDlp\ mod DisplayName REG_SZ @C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL,-11011 old REG

Загрузка данных
HKEY_CLASSES_ROOT\AppUserModelId\Windows.Defender.MpUxDlp\	mod
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL,-11011	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL,-11011	new
HKEY_CLASSES_ROOT\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\DefenderCSP.dll"	old
	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\DefenderCSP.dll"	new
HKEY_CLASSES_ROOT\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpOav.dll"	old
	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpOav.dll"	new
HKEY_CLASSES_ROOT\CLSID\{2DCD7FDB-8809-48E4-8E4F-3157C57CF987}\InprocServer32\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL	new
HKEY_CLASSES_ROOT\CLSID\{301065FE-60AD-49C8-B24D-97D598A6BD49}\	mod
LocalizedString	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL,-11012	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL,-11012	new
HKEY_CLASSES_ROOT\CLSID\{301065FE-60AD-49C8-B24D-97D598A6BD49}\Elevation\	mod
IconReference	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL,-101	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL,-101	new
HKEY_CLASSES_ROOT\CLSID\{301065FE-60AD-49C8-B24D-97D598A6BD49}\InprocServer32\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL	new
HKEY_CLASSES_ROOT\CLSID\{4DB116D1-9B24-4DFC-946B-BFE03E852002}\InProcServer32\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL	new
HKEY_CLASSES_ROOT\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\ProtectionManagement.dll"	old
	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\ProtectionManagement.dll"	new
HKEY_CLASSES_ROOT\Local Settings\MuiCache\3b\B1A07F78\	mod
@%SystemRoot%\System32\acppage.dll,-6006	REG_SZ	Совместимость программ	add
@%systemroot%\system32\rshx32.DLL,-59	REG_SZ	Редактор прав доступа к файлам и папкам	add
@%systemroot%\system32\SecurityHealthAgent.dll,-12001	REG_SZ	Безопасность Windows	add
@%SystemRoot%\System32\urlmon.dll,-4200	REG_SZ	Открытие файла - предупреждение системы безопасности	add
@C:\Program Files\Common Files\Microsoft Shared\Office16\oregres.dll,-120	REG_SZ	Документ Microsoft Word 97–2003	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-240	REG_SZ	Позволяет пользователям защититься от вредоносных и иных потенциально нежелательных программ	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	REG_SZ	Позволяет защититься от попыток вторжения, нацеленных на известные и вновь обнаруженные уязвимости в сетевых протоколах	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-244	REG_SZ	Отслеживает доступность, работоспособность и производительность различных компонентов безопасности	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-340	REG_SZ	Драйвер с функцией мини-фильтра в составе антивирусной программы Microsoft Defender для защиты от вредоносных программ во время доступа	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-400	REG_SZ	Драйвер загрузки антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-440	REG_SZ	Мĩςřōšőƒт Đ℮ƒęńďëŕ Ņèτẃöřķ íйśφêςтîσņ ðŕĭνεг ƒòѓ ĄĨ	add
@C:\Windows\system32\ieframe.dll,-5723	REG_SZ	Интернет	add
@C:\Windows\system32\SecurityHealthAgent.dll,-12001	REG_SZ	Безопасность Windows	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\AllUsers\{23F61DFC-4B6B-4754-BE88-8E2BA820D95B}\	mod
From	REG_QWORD	00 00 00 00 00 00 00 00 	old
	REG_QWORD	0c 00 00 00 00 00 00 00 	new
Version	REG_QWORD	00 00 00 00 00 00 00 00 	old
	REG_QWORD	0c 00 00 00 00 00 00 00 	new
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppX8zw7xct41bx2wrswqekb78rm243h02yh\	del
Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	REG_SZ		del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXajsqtzxc3swn530gvypre9jp1rp1d2tp\	del
Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	REG_SZ		del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-phone\AppXajsqtzxc3swn530gvypre9jp1rp1d2tp\	del
Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	REG_SZ		del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\tel\AppX8zw7xct41bx2wrswqekb78rm243h02yh\	del
Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	REG_SZ		del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe\	del
Path	REG_SZ	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe	del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe\	del
Path	REG_SZ	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe	del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe\	del
Path	REG_SZ	C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe	del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\	del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\	del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\windows.protocol\	del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\windows.protocol\ms-phone\	del
ACID	REG_SZ	PhoneExperienceHost.exe	del
DisplayName	REG_SZ	ms-resource:AppName	del
Logo	REG_SZ	Assets\AppTiles\AppIcon.png	del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\windows.protocol\tel\	del
ACID	REG_SZ	PhoneExperienceHost.exe	del
DisplayName	REG_SZ	ms-resource:AppName	del
Logo	REG_SZ	Assets\AppTiles\AppIcon.png	del
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\InputApp_cw5n1h2txyewy\HAM\AUI\App\V1\LU\	mod
ICT	REG_QWORD	4e bc c4 32 08 55 dd 01 	old
	REG_QWORD	a5 dc 8d 82 4e 61 dd 01 	new
ITT	REG_QWORD	9e b8 d8 32 08 55 dd 01 	old
	REG_QWORD	79 53 a3 82 4e 61 dd 01 	new
PCT	REG_QWORD	5c 1a ae 32 08 55 dd 01 	old
	REG_QWORD	76 bf 7a 82 4e 61 dd 01 	new
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\HAM\AUI\App\V1\LU\	mod
PCT	REG_QWORD	69 ca 68 d8 4d 61 dd 01 	old
	REG_QWORD	80 ab e4 64 4f 61 dd 01 	new
PTT	REG_QWORD	69 75 a9 fc 4d 61 dd 01 	old
	REG_QWORD	ca 6a b6 88 4f 61 dd 01 	new
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\HAM\AUI\SecHealthUI\V1\LU\	mod
ICT	REG_QWORD	2b c5 6c 14 24 55 dd 01 	old
	REG_QWORD	fc 8b 8d 20 4f 61 dd 01 	new
ITT	REG_QWORD	37 b7 0e 24 24 55 dd 01 	old
	REG_QWORD	16 f1 27 40 4f 61 dd 01 	new
PCT	REG_QWORD	39 ce 88 0e 24 55 dd 01 	old
	REG_QWORD	64 64 75 20 4f 61 dd 01 	new
PTT	REG_QWORD	45 0f 22 24 24 55 dd 01 	old
	REG_QWORD	5b 9b 30 40 4f 61 dd 01 	new
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1\LU\	mod
ICT	REG_QWORD	c6 87 f5 0c 24 55 dd 01 	old
	REG_QWORD	71 a4 9b 25 4f 61 dd 01 	new
ITT	REG_QWORD	c2 be 9b 0e 24 55 dd 01 	old
	REG_QWORD	75 ef da 29 4f 61 dd 01 	new
PCT	REG_QWORD	03 c3 4f 08 24 55 dd 01 	old
	REG_QWORD	37 3e ed 1b 4f 61 dd 01 	new
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory\	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\	mod
05	00	00	00	09	00	00	00	00	00	00	00	01	00	00	00
01								05				00			
06	00	00	00	08	00	00	00	07	00	00	00	02	00	00	00
															
04	00	00	00	03	00	00	00	ff	ff	ff	ff				
															
MRUListEx	REG_BINARY		mod
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02											 ... (94)
												 ... (96)
NodeSlots	REG_BINARY		mod
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\	mod
03	00	00	00	02	00	00	00	01	00	00	00	04	00	00	00
01				03				02							
00	00	00	00	ff	ff	ff	ff								
															
MRUListEx	REG_BINARY		mod
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\	mod
5	REG_BINARY	66 00 31 00 00 00 00 00 cc 56 7d 66 10 00 50 52 4f 43 45 53 7e 31 00 00 4e 00 09 00 04 00 ef be cc 56 7c 66 55 5d 87 5a 2e 00 00 00 96 a2 01 00 00 00  ... (104)	add
01	00	00	00	03	00	00	00	04	00	00	00	02	00	00	00
05				01				03				04			
00	00	00	00	ff	ff	ff	ff								
02				00	00	00	00	ff	ff	ff	ff				
MRUListEx	REG_BINARY		mod
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\5\	add
MRUListEx	REG_BINARY	ff ff ff ff 	add
NodeSlot	REG_DWORD	0x0000005f (95)	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\	mod
1	REG_BINARY	56 00 31 00 00 00 00 00 45 5d 14 99 10 00 72 65 73 75 6c 74 73 00 40 00 09 00 04 00 ef be 45 5d 14 99 55 5d b8 5a 2e 00 00 00 e9 64 01 00 00 00 09 00  ... (88)	add
00	00	00	00	ff	ff	ff	ff								
01				00	00	00	00	ff	ff	ff	ff				
MRUListEx	REG_BINARY		mod
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\1\	add
MRUListEx	REG_BINARY	ff ff ff ff 	add
NodeSlot	REG_DWORD	0x00000060 (96)	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\9\	mod
02	00	00	00	01	00	00	00	00	00	00	00	ff	ff	ff	ff
01				02											
MRUListEx	REG_BINARY		mod
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\	add
ColInfo	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1  ... (136)	add
FFlags	REG_DWORD	0x00000001 (1)	add
GroupByDirection	REG_DWORD	0x00000001 (1)	add
GroupByKey:FMTID	REG_SZ	{00000000-0000-0000-0000-000000000000}	add
GroupByKey:PID	REG_DWORD	0x00000000 (0)	add
GroupView	REG_DWORD	0x00000000 (0)	add
IconSize	REG_DWORD	0x00000010 (16)	add
LogicalViewMode	REG_DWORD	0x00000001 (1)	add
Mode	REG_DWORD	0x00000004 (4)	add
Sort	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\Shell\	add
SniffedFolderType	REG_SZ	Generic	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\ComDlg\	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\	add
ColInfo	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1  ... (136)	add
FFlags	REG_DWORD	0x00000001 (1)	add
GroupByDirection	REG_DWORD	0x00000001 (1)	add
GroupByKey:FMTID	REG_SZ	{00000000-0000-0000-0000-000000000000}	add
GroupByKey:PID	REG_DWORD	0x00000000 (0)	add
GroupView	REG_DWORD	0x00000000 (0)	add
IconSize	REG_DWORD	0x00000010 (16)	add
LogicalViewMode	REG_DWORD	0x00000001 (1)	add
Mode	REG_DWORD	0x00000004 (4)	add
Sort	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\Shell\	add
SniffedFolderType	REG_SZ	Generic	add
HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\	mod
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe.ApplicationCompany	REG_SZ	ThinPrint AG	add
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe.FriendlyAppName	REG_SZ	TPVCGateway Service	add
HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\X86\MpOav.dll"	old
	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\X86\MpOav.dll"	new
HKEY_CURRENT_USER\Software\Classes\Local Settings\MuiCache\3b\B1A07F78\	mod
@%SystemRoot%\System32\acppage.dll,-6006	REG_SZ	Совместимость программ	add
@%systemroot%\system32\rshx32.DLL,-59	REG_SZ	Редактор прав доступа к файлам и папкам	add
@%systemroot%\system32\SecurityHealthAgent.dll,-12001	REG_SZ	Безопасность Windows	add
@%SystemRoot%\System32\urlmon.dll,-4200	REG_SZ	Открытие файла - предупреждение системы безопасности	add
@C:\Program Files\Common Files\Microsoft Shared\Office16\oregres.dll,-120	REG_SZ	Документ Microsoft Word 97–2003	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-240	REG_SZ	Позволяет пользователям защититься от вредоносных и иных потенциально нежелательных программ	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	REG_SZ	Позволяет защититься от попыток вторжения, нацеленных на известные и вновь обнаруженные уязвимости в сетевых протоколах	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-244	REG_SZ	Отслеживает доступность, работоспособность и производительность различных компонентов безопасности	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-340	REG_SZ	Драйвер с функцией мини-фильтра в составе антивирусной программы Microsoft Defender для защиты от вредоносных программ во время доступа	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-400	REG_SZ	Драйвер загрузки антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-440	REG_SZ	Мĩςřōšőƒт Đ℮ƒęńďëŕ Ņèτẃöřķ íйśφêςтîσņ ðŕĭνεг ƒòѓ ĄĨ	add
@C:\Windows\system32\ieframe.dll,-5723	REG_SZ	Интернет	add
@C:\Windows\system32\SecurityHealthAgent.dll,-12001	REG_SZ	Безопасность Windows	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\InputApp_cw5n1h2txyewy\HAM\AUI\App\V1\LU\	mod
ICT	REG_QWORD	4e bc c4 32 08 55 dd 01 	old
	REG_QWORD	a5 dc 8d 82 4e 61 dd 01 	new
ITT	REG_QWORD	9e b8 d8 32 08 55 dd 01 	old
	REG_QWORD	79 53 a3 82 4e 61 dd 01 	new
PCT	REG_QWORD	5c 1a ae 32 08 55 dd 01 	old
	REG_QWORD	76 bf 7a 82 4e 61 dd 01 	new
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\HAM\AUI\App\V1\LU\	mod
PCT	REG_QWORD	69 ca 68 d8 4d 61 dd 01 	old
	REG_QWORD	80 ab e4 64 4f 61 dd 01 	new
PTT	REG_QWORD	69 75 a9 fc 4d 61 dd 01 	old
	REG_QWORD	ca 6a b6 88 4f 61 dd 01 	new
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\HAM\AUI\SecHealthUI\V1\LU\	mod
ICT	REG_QWORD	2b c5 6c 14 24 55 dd 01 	old
	REG_QWORD	fc 8b 8d 20 4f 61 dd 01 	new
ITT	REG_QWORD	37 b7 0e 24 24 55 dd 01 	old
	REG_QWORD	16 f1 27 40 4f 61 dd 01 	new
PCT	REG_QWORD	39 ce 88 0e 24 55 dd 01 	old
	REG_QWORD	64 64 75 20 4f 61 dd 01 	new
PTT	REG_QWORD	45 0f 22 24 24 55 dd 01 	old
	REG_QWORD	5b 9b 30 40 4f 61 dd 01 	new
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1\LU\	mod
ICT	REG_QWORD	c6 87 f5 0c 24 55 dd 01 	old
	REG_QWORD	71 a4 9b 25 4f 61 dd 01 	new
ITT	REG_QWORD	c2 be 9b 0e 24 55 dd 01 	old
	REG_QWORD	75 ef da 29 4f 61 dd 01 	new
PCT	REG_QWORD	03 c3 4f 08 24 55 dd 01 	old
	REG_QWORD	37 3e ed 1b 4f 61 dd 01 	new
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory\	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\	mod
05	00	00	00	09	00	00	00	00	00	00	00	01	00	00	00
01								05				00			
06	00	00	00	08	00	00	00	07	00	00	00	02	00	00	00
															
04	00	00	00	03	00	00	00	ff	ff	ff	ff				
															
MRUListEx	REG_BINARY		mod
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02											 ... (94)
												 ... (96)
NodeSlots	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\	mod
03	00	00	00	02	00	00	00	01	00	00	00	04	00	00	00
01				03				02							
00	00	00	00	ff	ff	ff	ff								
															
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\	mod
5	REG_BINARY	66 00 31 00 00 00 00 00 cc 56 7d 66 10 00 50 52 4f 43 45 53 7e 31 00 00 4e 00 09 00 04 00 ef be cc 56 7c 66 55 5d 87 5a 2e 00 00 00 96 a2 01 00 00 00  ... (104)	add
01	00	00	00	03	00	00	00	04	00	00	00	02	00	00	00
05				01				03				04			
00	00	00	00	ff	ff	ff	ff								
02				00	00	00	00	ff	ff	ff	ff				
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\5\	add
MRUListEx	REG_BINARY	ff ff ff ff 	add
NodeSlot	REG_DWORD	0x0000005f (95)	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\	mod
1	REG_BINARY	56 00 31 00 00 00 00 00 45 5d 14 99 10 00 72 65 73 75 6c 74 73 00 40 00 09 00 04 00 ef be 45 5d 14 99 55 5d b8 5a 2e 00 00 00 e9 64 01 00 00 00 09 00  ... (88)	add
00	00	00	00	ff	ff	ff	ff								
01				00	00	00	00	ff	ff	ff	ff				
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\1\	add
MRUListEx	REG_BINARY	ff ff ff ff 	add
NodeSlot	REG_DWORD	0x00000060 (96)	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\9\	mod
02	00	00	00	01	00	00	00	00	00	00	00	ff	ff	ff	ff
01				02											
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\	add
ColInfo	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1  ... (136)	add
FFlags	REG_DWORD	0x00000001 (1)	add
GroupByDirection	REG_DWORD	0x00000001 (1)	add
GroupByKey:FMTID	REG_SZ	{00000000-0000-0000-0000-000000000000}	add
GroupByKey:PID	REG_DWORD	0x00000000 (0)	add
GroupView	REG_DWORD	0x00000000 (0)	add
IconSize	REG_DWORD	0x00000010 (16)	add
LogicalViewMode	REG_DWORD	0x00000001 (1)	add
Mode	REG_DWORD	0x00000004 (4)	add
Sort	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\Shell\	add
SniffedFolderType	REG_SZ	Generic	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\ComDlg\	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\	add
ColInfo	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1  ... (136)	add
FFlags	REG_DWORD	0x00000001 (1)	add
GroupByDirection	REG_DWORD	0x00000001 (1)	add
GroupByKey:FMTID	REG_SZ	{00000000-0000-0000-0000-000000000000}	add
GroupByKey:PID	REG_DWORD	0x00000000 (0)	add
GroupView	REG_DWORD	0x00000000 (0)	add
IconSize	REG_DWORD	0x00000010 (16)	add
LogicalViewMode	REG_DWORD	0x00000001 (1)	add
Mode	REG_DWORD	0x00000004 (4)	add
Sort	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\Shell\	add
SniffedFolderType	REG_SZ	Generic	add
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\	mod
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe.ApplicationCompany	REG_SZ	ThinPrint AG	add
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe.FriendlyAppName	REG_SZ	TPVCGateway Service	add
HKEY_CURRENT_USER\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\	add
HKEY_CURRENT_USER\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\SOFTWARE\	add
HKEY_CURRENT_USER\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\SOFTWARE\Microsoft\	add
HKEY_CURRENT_USER\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\	add
HKEY_CURRENT_USER\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\	add
DefaultTokenId	REG_SZ	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo\	mod
2259DE09-A10D-947E-641F-56694FF2531D	REG_MULTI_SZ	1㌷10੻†∠慄慴慢敳湉瑳湡散摉•›㤵ㄶⰶ †匢煥敵据≥㨠㌠ㄸⰰ †愢瑣癩瑩卹潴敲摉•›㈢㔲䐹ぅⴹㅁ䐰㤭㜴ⵅ㐶䘱㔭㘶㐹䙆㔲ㄳ≄ਬ†∠楦瑬牥•›੻†††椢剳慥䙤汩整≲㨠〠ਬ†††漢楲楧䙮汩整䭲祥•›ⰰ ††∠瑳瑡䙥汩整䭲祥•›ⰰ ††∠獵牥捁楴湯瑓瑡䙥汩整≲㨠〠 †੽੽	old
	REG_MULTI_SZ	1㌷10੻†∠慄慴慢敳湉瑳湡散摉•›㤵ㄶⰶ †匢煥敵据≥㨠㌠㜸ⰲ †愢瑣癩瑩卹潴敲摉•›㈢㔲䐹ぅⴹㅁ䐰㤭㜴ⵅ㐶䘱㔭㘶㐹䙆㔲ㄳ≄ਬ†∠楦瑬牥•›੻†††椢剳慥䙤汩整≲㨠〠ਬ†††漢楲楧䙮汩整䭲祥•›ⰰ ††∠瑳瑡䙥汩整䭲祥•›ⰰ ††∠獵牥捁楴湯瑓瑡䙥汩整≲㨠〠 †੽੽	new
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\GlobalSettings\	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\GlobalSettings\ProperTreeModuleInner\	add
ProperTreeModuleInner	REG_BINARY	9c 00 00 00 98 00 00 00 31 53 50 53 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 3b 00 00 00 2a 00 00 00 00 4e 00 61 00 76 00 50 00 61 00 6e 00 65  ... (160)	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU\	mod
3	REG_BINARY	50 00 72 00 6f 00 63 00 6d 00 6f 00 6e 00 36 00 34 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ... (592)	add
02	00	00	00	01	00	00	00	00	00	00	00	ff	ff	ff	ff
03				02				01				00	00	00	00
															
ff	ff	ff	ff												
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU\	mod
3	REG_BINARY	50 00 72 00 6f 00 63 00 6d 00 6f 00 6e 00 36 00 34 00 2e 00 65 00 78 00 65 00 00 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00  ... (234)	add
01	00	00	00	02	00	00	00	00	00	00	00	ff	ff	ff	ff
03				01				02				00	00	00	00
															
ff	ff	ff	ff												
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\	mod
3	REG_BINARY	14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 2e 80 3a cc bf b4 2c db 4c 42 b0 29 7f e9 9a 87 c6 41 4e 00 31 00 00 00 00 00 45 5d  ... (304)	add
02	00	00	00	01	00	00	00	00	00	00	00	ff	ff	ff	ff
03				02				01				00	00	00	00
															
ff	ff	ff	ff												
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\PML\	add
0	REG_BINARY	14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 2e 80 3a cc bf b4 2c db 4c 42 b0 29 7f e9 9a 87 c6 41 4e 00 31 00 00 00 00 00 45 5d  ... (304)	add
MRUListEx	REG_BINARY	00 00 00 00 ff ff ff ff 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched\	mod
C:\Users\user\Desktop\tools\ProcessMonitor\Procmon64.exe	REG_DWORD	0x00000001 (1)	add
C:\Users\user\Desktop\tools\SysTracer x64\SysTracer.exe	REG_DWORD	0x00000002 (2)	old
	REG_DWORD	0x00000004 (4)	new
Microsoft.Windows.Explorer	REG_DWORD	0x0000001a (26)	old
	REG_DWORD	0x0000001e (30)	new
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\OpenWithList\	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\OpenWithProgids\	add
ProcMon.Logfile.1	REG_NONE		add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\	mod
3f	00	74	00	68	00	72	00	65	00	61	00	74	00	49	00
75		70		64		61		74		65		2f		00	
64	00	3d	00	32	00	31	00	34	00	37	00	36	00	38	00
96		32		00		00		00		00		00		77	69
35	00	31	00	38	00	30	00	00	00	de	00	32	00	00	00
6e	64	6f	77	73	64	65	66	65	6e	64	65	72	2d	2d	75
00	00											 ... (266)
70	64											 ... (168)
0	REG_BINARY		mod
45	REG_BINARY	75 00 70 00 64 00 61 00 74 00 65 00 2f 00 00 00 96 00 32 00 00 00 00 00 00 00 00 00 00 00 77 69 6e 64 6f 77 73 64 65 66 65 6e 64 65 72 2d 2d 75 70 64  ... (168)	add
46	REG_BINARY	4c 00 6f 00 67 00 66 00 69 00 6c 00 65 00 2e 00 50 00 4d 00 4c 00 00 00 6e 00 32 00 00 00 00 00 00 00 00 00 00 00 4c 6f 67 66 69 6c 65 2e 50 4d 4c 2e  ... (136)	add
2c	00	00	00	01	00	00	00	2b	00	00	00	2a	00	00	00
25				2e				01				2d			
29	00	00	00	23	00	00	00	00	00	00	00	1e	00	00	00
24				2c				2b				2a			
28	00	00	00	27	00	00	00	26	00	00	00	18	00	00	00
29				23				00				1e			
1d	00											 ... (184)
28												 ... (192)
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.PML\	add
0	REG_BINARY	4c 00 6f 00 67 00 66 00 69 00 6c 00 65 00 2e 00 50 00 4d 00 4c 00 00 00 6e 00 32 00 00 00 00 00 00 00 00 00 00 00 4c 6f 67 66 69 6c 65 2e 50 4d 4c 2e  ... (136)	add
MRUListEx	REG_BINARY	00 00 00 00 ff ff ff ff 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\	mod
13	REG_BINARY	72 00 65 00 73 00 75 00 6c 00 74 00 73 00 00 00 62 00 32 00 00 00 00 00 00 00 00 00 00 00 72 65 73 75 6c 74 73 2e 6c 6e 6b 00 48 00 09 00 04 00 ef be  ... (116)	add
00	00	00	00	0c	00	00	00	0b	00	00	00	0a	00	00	00
0d				00				0c				0b			
09	00	00	00	08	00	00	00	01	00	00	00	07	00	00	00
0a				09				08				01			
06	00	00	00	03	00	00	00	04	00	00	00	05	00	00	00
07				06				03				04			
02	00											 ... (56)
05												 ... (60)
MRUListEx	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000300B2\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000003049A\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000003055C\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 f4 2b 57 86 13 7d b8 4a 8c a2 6e 91 4a b7 09 bc 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000305E6\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000030614\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000003061A\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000004045A\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000502F0\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000005057E\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000604DA\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060594\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000605D6\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000070452\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000007047C\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000007057E\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000080460\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000805E6\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000090460\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000904DA\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B02DC\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B047C\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C01E6\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\WRT:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!SecHealthUI+1+0000000000040582\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\	mod
00	00	00	00	29	01	00	00	fb	02	00	00	25	65	3d	01
				2a				0a	03			5f	3c	47	
42	00	00	00	33	00	00	00	08	85	0f	00	7b	00	31	00
															
41	00	43	00	31	00	34	00	45	00	37	00	37	00	2d	00
															
30	00											 ... (1612)
												 ... (1612)
HRZR_PGYFRFFVBA	REG_BINARY		mod
00	00	00	00	03	00	00	00	05	00	00	00	34	e3	02	00
								09				e3	31	06	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
P:\Hfref\hfre\Qrfxgbc\gbbyf\CebprffZbavgbe\Cebpzba64.rkr	REG_BINARY		mod
00	00	00	00	04	00	00	00	07	00	00	00	cb	da	01	00
								08				ad	1a	03	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
P:\Hfref\hfre\Qrfxgbc\gbbyf\FlfGenpre k64\FlfGenpre.rkr	REG_BINARY		mod
P:\Hfref\hfre\Qrfxgbc\yno1\fep\TerlRaretlQebccre.rkr	REG_BINARY	00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00  ... (72)	add
00	00	00	00	05	00	00	00	0a	00	00	00	83	ec	03	00
				06				0c				ec	89	04	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
Zvpebfbsg.Jvaqbjf.FrpUrnyguHV_pj5a1u2gklrjl!FrpUrnyguHV	REG_BINARY		mod
00	00	00	00	00	00	00	00	07	00	00	00	ce	d8	00	00
												a3	da		
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
Zvpebfbsg.Jvaqbjf.FuryyRkcrevraprUbfg_pj5a1u2gklrjl!Ncc	REG_BINARY		mod
00	00	00	00	31	00	00	00	e9	00	00	00	7b	8b	63	00
								f0				4b	95	67	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
Zvpebfbsg.Jvaqbjf.Rkcybere	REG_BINARY		mod
00	00	00	00	00	00	00	00	01	00	00	00	73	7c	00	00
								02				0e	1c	01	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\RnfrBsNpprffQvnybt.rkr	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState\	mod
PolicyState	REG_DWORD	0x00000002 (2)	old
	REG_DWORD	0x00000000 (0)	new
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\InstallService\State\	mod
AutoUpdateLastSuccessTime	REG_SZ	2026-10-06T22:17:48+03:00	old
	REG_SZ	2026-10-21T14:24:16+03:00	new
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012026100520261006\	del
CacheLimit	REG_DWORD	0x00000001 (1)	del
CacheOptions	REG_DWORD	0x0000000b (11)	del
CachePath	REG_SZ	C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026100520261006	del
CachePrefix	REG_SZ	:2026100520261006: 	del
CacheRelativePath	REG_SZ	Microsoft\Windows\History\History.IE5\MSHist012026100520261006	del
CacheRepair	REG_DWORD	0x00000000 (0)	del
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012026100520261012\	add
CacheLimit	REG_DWORD	0x00000001 (1)	add
CacheOptions	REG_DWORD	0x0000000b (11)	add
CachePath	REG_SZ	C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026100520261012	add
CachePrefix	REG_SZ	:2026100520261012: 	add
CacheRelativePath	REG_SZ	Microsoft\Windows\History\History.IE5\MSHist012026100520261012	add
CacheRepair	REG_DWORD	0x00000000 (0)	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012026100620261007\	del
CacheLimit	REG_DWORD	0x00000001 (1)	del
CacheOptions	REG_DWORD	0x0000000b (11)	del
CachePath	REG_SZ	C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026100620261007	del
CachePrefix	REG_SZ	:2026100620261007: 	del
CacheRelativePath	REG_SZ	Microsoft\Windows\History\History.IE5\MSHist012026100620261007	del
CacheRepair	REG_DWORD	0x00000000 (0)	del
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012026102120261022\	add
CacheLimit	REG_DWORD	0x00000001 (1)	add
CacheOptions	REG_DWORD	0x0000000b (11)	add
CachePath	REG_SZ	C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026102120261022	add
CachePrefix	REG_SZ	:2026102120261022: 	add
CacheRelativePath	REG_SZ	Microsoft\Windows\History\History.IE5\MSHist012026102120261022	add
CacheRepair	REG_DWORD	0x00000000 (0)	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\	mod
95	dc	c3	6a	00	00	00	00								
91	a1	d8													
QuietHoursTelemetryLastRun	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData\	add
C:\Users\user\Desktop\tools\ProcessMonitor\Procmon64.exe	REG_QWORD	b5 6d 8e ba 4f 61 dd 01 	add
Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!SecHealthUI	REG_QWORD	1f e8 d2 24 4f 61 dd 01 	add
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100\	mod
23	00	41	00	43	00	42	00	6c	00	6f	00	62	00	00	00
															
00	00	00	00	00	00	00	00	01	00	00	00	00	00	00	00
												74		65	
00	00	00	00												
6d															
CheckSetting	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102\	mod
23	00	41	00	43	00	42	00	6c	00	6f	00	62	00	00	00
															
00	00	00	00	00	00	00	00	01	00	00	00	00	00	00	00
												74		65	
00	00	00	00												
6d															
CheckSetting	REG_BINARY		mod
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\	mod
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe	REG_BINARY	53 41 43 50 01 00 00 00 00 00 00 00 07 00 00 00 28 00 00 00 78 63 03 00 d7 ea 03 00 01 00 00 00 00 00 00 00 00 00 01 06 71 00 00 00 63 1f 6e 6f 0e de  ... (108)	add
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\HostActivityManager\CommitHistory\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!SecHealthUI\	mod
Mixed	REG_QWORD	00 00 ca 03 00 00 00 00 	old
	REG_QWORD	00 00 c5 03 00 00 00 00 	new
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\HostActivityManager\Volatile\	mod
Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!SecHealthUI	REG_DWORD	0x00000100 (256)	add
HKEY_CURRENT_USER\Software\Sysinternals\Process Monitor\	mod
SaveDialog	REG_BINARY	2c 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 58 00 00 00 75 00 00 00 38 02 00 00 06 02 00 00 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppUserModelId\Windows.Defender.MpUxDlp\	mod
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL,-11011	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL,-11011	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\DefenderCSP.dll"	old
	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\DefenderCSP.dll"	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpOav.dll"	old
	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpOav.dll"	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2DCD7FDB-8809-48E4-8E4F-3157C57CF987}\InprocServer32\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{301065FE-60AD-49C8-B24D-97D598A6BD49}\	mod
LocalizedString	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL,-11012	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL,-11012	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{301065FE-60AD-49C8-B24D-97D598A6BD49}\Elevation\	mod
IconReference	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL,-101	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL,-101	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{301065FE-60AD-49C8-B24D-97D598A6BD49}\InprocServer32\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB116D1-9B24-4DFC-946B-BFE03E852002}\InProcServer32\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MPUXAGENT.DLL	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MPUXAGENT.DLL	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\ProtectionManagement.dll"	old
	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\ProtectionManagement.dll"	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\AllUsers\{23F61DFC-4B6B-4754-BE88-8E2BA820D95B}\	mod
From	REG_QWORD	00 00 00 00 00 00 00 00 	old
	REG_QWORD	0c 00 00 00 00 00 00 00 	new
Version	REG_QWORD	00 00 00 00 00 00 00 00 	old
	REG_QWORD	0c 00 00 00 00 00 00 00 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppX8zw7xct41bx2wrswqekb78rm243h02yh\	del
Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	REG_SZ		del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs\AppXajsqtzxc3swn530gvypre9jp1rp1d2tp\	del
Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	REG_SZ		del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-phone\AppXajsqtzxc3swn530gvypre9jp1rp1d2tp\	del
Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	REG_SZ		del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\tel\AppX8zw7xct41bx2wrswqekb78rm243h02yh\	del
Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	REG_SZ		del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe\	del
Path	REG_SZ	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe	del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe\	del
Path	REG_SZ	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe	del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe\	del
Path	REG_SZ	C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe	del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\windows.protocol\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\windows.protocol\ms-phone\	del
ACID	REG_SZ	PhoneExperienceHost.exe	del
DisplayName	REG_SZ	ms-resource:AppName	del
Logo	REG_SZ	Assets\AppTiles\AppIcon.png	del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Packages\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\Microsoft.YourPhone_8wekyb3d8bbwe!App\windows.protocol\tel\	del
ACID	REG_SZ	PhoneExperienceHost.exe	del
DisplayName	REG_SZ	ms-resource:AppName	del
Logo	REG_SZ	Assets\AppTiles\AppIcon.png	del
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\X86\MpOav.dll"	old
	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\X86\MpOav.dll"	new
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\NativeMessagingHosts\com.microsoft.defender.browser_extension.native_message_host\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\com.microsoft.defender.be.chrome.json	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\com.microsoft.defender.be.chrome.json	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\CatDBTempFiles\C:*Windows*system32*CatRoot*TMPE6AC.tmp\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Edge\NativeMessagingHosts\com.microsoft.defender.browser_extension.native_message_host\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\com.microsoft.defender.be.chrome.json	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\com.microsoft.defender.be.chrome.json	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData\	mod
ClockTimeSeconds	REG_QWORD	45 a0 d8 6a 00 00 00 00 	old
	REG_QWORD	c9 a0 d8 6a 00 00 00 00 	new
TickCount	REG_QWORD	58 db 04 00 00 00 00 00 	old
	REG_QWORD	3d de 06 00 00 00 00 00 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\	add
LastAccountPersistentFailureTimestamp	REG_QWORD	00 00 00 00 00 00 00 00 	add
LastSuccessfulRequestTimestamp	REG_QWORD	60 d0 34 a7 4e 61 dd 01 	add
NegativeCacheState	REG_DWORD	0x00000000 (0)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\settings-win.data.microsoft.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	e5 76 8f b7 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{28520974-CE92-4F36-A219-3F255AF7E61E}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{28520974-CE92-4F36-A219-3F255AF7E61E}\dcat.update.microsoft.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	46 64 1d b5 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{2B379600-B42B-4FE9-A59C-A312FB934935}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{2B379600-B42B-4FE9-A59C-A312FB934935}\https://events.data.microsoft.com_NFS_1wk_compact_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	cd 92 07 af 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{2B379600-B42B-4FE9-A59C-A312FB934935}\https://settings-win.data.microsoft.com/settings/v3.0/_NFS_1wk_compact_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	b9 d1 a2 58 4e 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{76236E1A-74C6-4CC0-93CB-9D3E85E5138F}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{76236E1A-74C6-4CC0-93CB-9D3E85E5138F}\https://settings-win.data.microsoft.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	1a 37 7b b3 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{975EE785-95FA-4566-990D-EA4B3D973061}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{975EE785-95FA-4566-990D-EA4B3D973061}\settings-win.data.microsoft.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	60 d0 34 a7 4e 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{A3D87918-9442-435E-9382-9B170962CAB4}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{A3D87918-9442-435E-9382-9B170962CAB4}\settings-win.data.microsoft.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	ae d2 c3 a3 4e 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{AE2D81FB-C9EB-44A6-806C-F543D3FABF6C}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{AE2D81FB-C9EB-44A6-806C-F543D3FABF6C}\settings-win.data.microsoft.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	a4 ca 80 b8 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\www.microsoft.com_mbi_ssl\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	23 ad f9 c1 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{D80D1001-5B38-49E9-9D34-EC9B84779189}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117476E_S-1-5-18\{D80D1001-5B38-49E9-9D34-EC9B84779189}\wns.windows.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	35 35 92 b7 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117DD52_S-1-5-19\	add
LastAccountPersistentFailureTimestamp	REG_QWORD	00 00 00 00 00 00 00 00 	add
LastSuccessfulRequestTimestamp	REG_QWORD	e3 4f b1 ac 4d 61 dd 01 	add
NegativeCacheState	REG_DWORD	0x00000000 (0)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117DD52_S-1-5-19\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\001840196117DD52_S-1-5-19\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\www.microsoft.com_mbi_ssl\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	e3 4f b1 ac 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\	add
LastAccountPersistentFailureTimestamp	REG_QWORD	00 00 00 00 00 00 00 00 	add
LastSuccessfulRequestTimestamp	REG_QWORD	b4 a4 c0 d8 4d 61 dd 01 	add
NegativeCacheState	REG_DWORD	0x00000000 (0)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742\cortana.bing.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x8004a98a (2147789194)	add
FailureType	REG_DWORD	0x00000001 (1)	add
RequestCount	REG_DWORD	0x00000004 (4)	add
StartedTime	REG_QWORD	5e ff 58 ba 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723\ads.arcct.msn.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	b4 a4 c0 d8 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\{28520974-CE92-4F36-A219-3F255AF7E61E}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\{28520974-CE92-4F36-A219-3F255AF7E61E}\dcat.update.microsoft.com_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	f8 20 eb be 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\{C89E2069-AF13-46DB-9E39-216131494B87}\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\NegativeCache\0018801921667C6E_S-1-5-21-2292890337-69778762-837601055-1001\{C89E2069-AF13-46DB-9E39-216131494B87}\474a-87ad-2f9a87615fa3-dc1-tip.cloudapp.net_MBI_SSL\	add
ErrorCode	REG_DWORD	0x00000000 (0)	add
FailureType	REG_DWORD	0x00000000 (0)	add
RequestCount	REG_DWORD	0x00000000 (0)	add
StartedTime	REG_QWORD	b3 49 0f c1 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{0CB4A94A-6E8C-477B-88C8-A3799FC97414}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	5a 81 70 b7 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{28520974-CE92-4F36-A219-3F255AF7E61E}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	89 5f fd b4 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{2B379600-B42B-4FE9-A59C-A312FB934935}\	add
ThrottleCount	REG_DWORD	0x00000002 (2)	add
ThrottleStartedTime	REG_QWORD	a9 3c cc ae 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{76236E1A-74C6-4CC0-93CB-9D3E85E5138F}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	48 63 2a ab 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{975EE785-95FA-4566-990D-EA4B3D973061}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	23 04 1c a7 4e 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{A3D87918-9442-435E-9382-9B170962CAB4}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	1c 02 8d a3 4e 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{AE2D81FB-C9EB-44A6-806C-F543D3FABF6C}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	da 35 64 b8 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	4d 53 e1 c1 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-18_{D80D1001-5B38-49E9-9D34-EC9B84779189}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	bc c8 72 b7 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-19_{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	b9 d9 58 ac 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-21-2292890337-69778762-837601055-1001_S-1-15-2-1861897761-1695161497-2927542615-642690995-327840285-2659745135-2630312742\	add
ThrottleCount	REG_DWORD	0x00000004 (4)	add
ThrottleStartedTime	REG_QWORD	b1 92 1a ba 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-21-2292890337-69778762-837601055-1001_S-1-15-2-350187224-1905355452-1037786396-3028148496-2624191407-3283318427-1255436723\	add
ThrottleCount	REG_DWORD	0x00000002 (2)	add
ThrottleStartedTime	REG_QWORD	ae e4 89 d8 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-21-2292890337-69778762-837601055-1001_{28520974-CE92-4F36-A219-3F255AF7E61E}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	d3 05 d1 be 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ThrottleCache\S-1-5-21-2292890337-69778762-837601055-1001_{C89E2069-AF13-46DB-9E39-216131494B87}\	add
ThrottleCount	REG_DWORD	0x00000001 (1)	add
ThrottleStartedTime	REG_QWORD	6d df e6 c0 4d 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MpSigStub\	mod
LastStartTime	REG_QWORD	a9 36 e7 e2 c6 55 dd 01 	old
	REG_QWORD	f6 55 46 1a 4f 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\	mod
6a	9e	25	dc	e2	55	dd	01								
1b	07	01	c8	4e	61										
LastSyncTime	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UNP\LocalState\Telemetry\	mod
GlobalEventCounter	REG_QWORD	9e 00 00 00 00 00 00 00 	old
	REG_QWORD	a8 00 00 00 00 00 00 00 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UNP\UpdateNotificationMgr\	mod
ConfigurationExpireDate	REG_QWORD	e0 24 f8 91 c7 60 dd 01 	old
	REG_QWORD	90 79 9d f5 4e 6c dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UNP\UpdateNotificationMgr\UNPCampaigns\{222ddb7c-4cb2-47ea-9193-8fb14e6b9e60}\	mod
ConfigurationExpireDate	REG_QWORD	60 0e 98 92 c7 60 dd 01 	old
	REG_QWORD	90 0a ee f5 4e 6c dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\UNP\UpdateNotificationMgr\UNPCampaigns\{7303707F-5807-4495-A0D9-0A019805F686}\	mod
ConfigurationExpireDate	REG_QWORD	50 21 3b 92 c7 60 dd 01 	old
	REG_QWORD	00 2a c3 f5 4e 6c dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\	mod
Autorecover MOFs	REG_MULTI_SZ	
%windir%\system32\wbem\cimwin32.mof
%windir%\system32\wbem\ncprov.mof
%windir%\system32\wbem\wmipcima.mof
%windir%\system32\wbem\secrcw32.mof
%windir%\system32\wbem\system.mof
%windir%\system32\wbem\interop.mof
%windir%\system32\wbem\wmi.mof
%windir%\system32\wbem\wmi_tracing.mof
%windir%\system32\ ... (13696)	old
	REG_MULTI_SZ	
%windir%\system32\wbem\cimwin32.mof
%windir%\system32\wbem\ncprov.mof
%windir%\system32\wbem\wmipcima.mof
%windir%\system32\wbem\secrcw32.mof
%windir%\system32\wbem\system.mof
%windir%\system32\wbem\interop.mof
%windir%\system32\wbem\wmi.mof
%windir%\system32\wbem\wmi_tracing.mof
%windir%\system32\ ... (13787)	new
Autorecover MOFs timestamp	REG_SZ	134357006804748823	old
	REG_SZ	134370556315748950	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\PROVIDERS\Performance\	mod
28	1b	00	00	01	00	00	00	00	00	00	00	10	00	00	00
															
18	1b	00	00	09	00	00	00	9a	00	00	00	01	00	00	00
															
01	00	00	00	40	00	00	00	1a	00	00	00	5c	00	5c	00
															
2e	00											 ... (6952)
												 ... (6952)
Performance Data	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\Origins\	mod
6ivKsuGVLKmuWrHAYEyqI9izSydEgJx60iorB69pAyk	REG_DWORD	0x00000002 (2)	del
7wdrUfCruShuAUNEy9rXAvqUzgzU2GCY5i/h3+caVpE	REG_DWORD	0x00000002 (2)	del
IxuG1Foi3wkJ2avEenKa1/nIP3oyM+sraHHE/sNxGPg	REG_DWORD	0x00000002 (2)	del
rHycBkTC6qm8XCUm2KnRtGneXHIt+jdy58ia5SqsALY	REG_DWORD	0x00000002 (2)	del
tMF/bZ08Nx+owTg3WglxjvQKSZnHcCoopCz9+tvO9jQ	REG_DWORD	0x00000002 (2)	del
TYqeewO6mhbyK/pM3KqksGK4KCfQr0hIMeneiOfGunY	REG_DWORD	0x00000002 (2)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StagingInfo\Microsoft.YourPhone_1.23052.125.0_neutral_split.language-ru_8wekyb3d8bbwe\	del
DownloadSize	REG_QWORD	da b6 00 00 00 00 00 00 	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StagingInfo\Microsoft.YourPhone_1.23052.125.0_neutral_split.scale-100_8wekyb3d8bbwe\	del
DownloadSize	REG_QWORD	db b5 00 00 00 00 00 00 	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StagingInfo\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\	del
DownloadSize	REG_QWORD	a9 25 9f 08 00 00 00 00 	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Data\a7\	del
_IndexKeys	REG_MULTI_SZ	Package\1c8\a7
PackageAndPackageRelativeApplicationId\1c8^App	del
ApplicationUserModelId	REG_SZ	Microsoft.YourPhone_8wekyb3d8bbwe!App	del
Entrypoint	REG_SZ	Windows.FullTrustApplication	del
Executable	REG_SZ	PhoneExperienceHost.exe	del
Flags	REG_DWORD	0x00000005 (5)	del
Index	REG_DWORD	0x00000000 (0)	del
Package	REG_DWORD	0x000001c8 (456)	del
PackageRelativeApplicationId	REG_SZ	App	del
StartPage	REG_NONE		del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\Package\1c8\a7\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\1c8^App\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Application\Index\PackageAndPackageRelativeApplicationId\1c8^App\a7\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\377\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\377
Category\windows.protocol\377	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.protocol	del
Index	REG_DWORD	0x00000000 (0)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\378\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\378
Category\windows.protocol\378	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.protocol	del
Index	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\379\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\379
Category\windows.cloudFiles\379	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.cloudFiles	del
Index	REG_DWORD	0x00000002 (2)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\37a\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\37a
Category\windows.startupTask\37a	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.startupTask	del
Index	REG_DWORD	0x00000003 (3)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\37b\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\37b
Category\windows.updateTask\37b	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.updateTask	del
Index	REG_DWORD	0x00000004 (4)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\37c\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\37c
Category\windows.preInstalledConfigTask\37c	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.preInstalledConfigTask	del
Index	REG_DWORD	0x00000005 (5)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\37d\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\37d
Category\windows.backgroundTasks\37d	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.backgroundTasks	del
Index	REG_DWORD	0x00000006 (6)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\37e\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\37e
Category\windows.comServer\37e	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.comServer	del
Index	REG_DWORD	0x00000007 (7)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\37f\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\37f
Category\windows.comInterface\37f	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.comInterface	del
Index	REG_DWORD	0x00000008 (8)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\380\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\380
Category\windows.shareTarget\380	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.shareTarget	del
Index	REG_DWORD	0x00000009 (9)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Data\381\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\381
Category\windows.appExtension\381	del
Application	REG_DWORD	0x000000a7 (167)	del
Category	REG_SZ	windows.appExtension	del
Index	REG_DWORD	0x0000000a (10)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\377\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\378\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\379\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\37a\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\37b\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\37c\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\37d\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\37e\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\37f\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\380\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Application\a7\381\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.appExtension\381\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.backgroundTasks\37d\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.cloudFiles\379\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.comInterface\37f\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.comServer\37e\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.preInstalledConfigTask\37c\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.protocol\377\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.protocol\378\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.shareTarget\380\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.startupTask\37a\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationExtension\Index\Category\windows.updateTask\37b\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Data\b0\	del
_IndexKeys	REG_MULTI_SZ	Application\a7\b0
UserAndApplication\1^a7
UserAndApplicationUserModelId\1^Microsoft.YourPhone_8wekyb3d8bbwe!App\b0	del
Application	REG_DWORD	0x000000a7 (167)	del
ApplicationUserModelId	REG_SZ	Microsoft.YourPhone_8wekyb3d8bbwe!App	del
User	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\Application\a7\b0\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\1^a7\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplication\1^a7\b0\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\ApplicationUser\Index\UserAndApplicationUserModelId\1^Microsoft.YourPhone_8wekyb3d8bbwe!App\b0\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\1bd\	del
_IndexKeys	REG_MULTI_SZ	PackageFamily\62\1bd
PackageFullName\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe	del
Flags	REG_DWORD	0x00000008 (8)	del
InstalledLocation	REG_SZ	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe	del
MutableLink	REG_NONE		del
MutableLocation	REG_NONE		del
OSMaxVersionTested	REG_QWORD	00 00 00 00 00 00 0c 00 	del
PackageFamily	REG_DWORD	0x00000062 (98)	del
PackageFullName	REG_SZ	Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe	del
PackageOrigin	REG_DWORD	0x00000003 (3)	del
PackageType	REG_DWORD	0x00000002 (2)	del
Volume	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\1c0\	del
_IndexKeys	REG_MULTI_SZ	PackageFamily\62\1c0
PackageFullName\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe	del
Flags	REG_DWORD	0x00000008 (8)	del
InstalledLocation	REG_SZ	C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe	del
MutableLink	REG_NONE		del
MutableLocation	REG_NONE		del
OSMaxVersionTested	REG_QWORD	00 00 00 00 00 00 0c 00 	del
PackageFamily	REG_DWORD	0x00000062 (98)	del
PackageFullName	REG_SZ	Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe	del
PackageOrigin	REG_DWORD	0x00000003 (3)	del
PackageType	REG_DWORD	0x00000002 (2)	del
Volume	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\1c7\	del
_IndexKeys	REG_MULTI_SZ	PackageFamily\54\1c7
PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe	del
Flags	REG_DWORD	0x00000000 (0)	del
InstalledLocation	REG_SZ	C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe	del
MutableLink	REG_NONE		del
MutableLocation	REG_NONE		del
OSMaxVersionTested	REG_QWORD	00 00 00 00 00 00 00 00 	del
PackageFamily	REG_DWORD	0x00000054 (84)	del
PackageFullName	REG_SZ	Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe	del
PackageOrigin	REG_DWORD	0x00000003 (3)	del
PackageType	REG_DWORD	0x00000008 (8)	del
Volume	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\1c8\	del
_IndexKeys	REG_MULTI_SZ	PackageFamily\54\1c8
PackageFullName\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	del
Flags	REG_DWORD	0x00000044 (68)	del
InstalledLocation	REG_SZ	C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	del
MutableLink	REG_NONE		del
MutableLocation	REG_NONE		del
OSMaxVersionTested	REG_QWORD	00 00 5d 58 00 00 0a 00 	del
PackageFamily	REG_DWORD	0x00000054 (84)	del
PackageFullName	REG_SZ	Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe	del
PackageOrigin	REG_DWORD	0x00000003 (3)	del
PackageType	REG_DWORD	0x00000001 (1)	del
Volume	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\1c9\	del
_IndexKeys	REG_MULTI_SZ	PackageFamily\54\1c9
PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_split.language-ru_8wekyb3d8bbwe	del
Flags	REG_DWORD	0x00000000 (0)	del
InstalledLocation	REG_SZ	C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23052.125.0_neutral_split.language-ru_8wekyb3d8bbwe	del
MutableLink	REG_NONE		del
MutableLocation	REG_NONE		del
OSMaxVersionTested	REG_QWORD	00 00 5d 58 00 00 0a 00 	del
PackageFamily	REG_DWORD	0x00000054 (84)	del
PackageFullName	REG_SZ	Microsoft.YourPhone_1.23052.125.0_neutral_split.language-ru_8wekyb3d8bbwe	del
PackageOrigin	REG_DWORD	0x00000003 (3)	del
PackageType	REG_DWORD	0x00000004 (4)	del
Volume	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Data\1ca\	del
_IndexKeys	REG_MULTI_SZ	PackageFamily\54\1ca
PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_split.scale-100_8wekyb3d8bbwe	del
Flags	REG_DWORD	0x00000000 (0)	del
InstalledLocation	REG_SZ	C:\Program Files\WindowsApps\Microsoft.YourPhone_1.23052.125.0_neutral_split.scale-100_8wekyb3d8bbwe	del
MutableLink	REG_NONE		del
MutableLocation	REG_NONE		del
OSMaxVersionTested	REG_QWORD	00 00 5d 58 00 00 0a 00 	del
PackageFamily	REG_DWORD	0x00000054 (84)	del
PackageFullName	REG_SZ	Microsoft.YourPhone_1.23052.125.0_neutral_split.scale-100_8wekyb3d8bbwe	del
PackageOrigin	REG_DWORD	0x00000003 (3)	del
PackageType	REG_DWORD	0x00000004 (4)	del
Volume	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\54\1c7\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\54\1c8\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\54\1c9\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\54\1ca\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\62\1bd\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFamily\62\1c0\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x64__8wekyb3d8bbwe\1c0\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.WindowsAppRuntime.1.3_3000.934.1904.0_x86__8wekyb3d8bbwe\1bd\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_split.language-ru_8wekyb3d8bbwe\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_split.language-ru_8wekyb3d8bbwe\1c9\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_split.scale-100_8wekyb3d8bbwe\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_split.scale-100_8wekyb3d8bbwe\1ca\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.YourPhone_1.23052.125.0_neutral_~_8wekyb3d8bbwe\1c7\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\Package\Index\PackageFullName\Microsoft.YourPhone_1.23052.125.0_x64__8wekyb3d8bbwe\1c8\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepositoryStatus\	mod
DeploymentDatabaseStatisticsLastUpdated	REG_QWORD	fa d4 c0 ac 4d 61 dd 01 	old
	REG_QWORD	14 01 f3 b1 4e 61 dd 01 	new
MachineDatabaseStatisticsLastUpdated	REG_QWORD	21 a5 e5 5d c7 55 dd 01 	old
	REG_QWORD	39 3e e7 b1 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx\NewDeploymentOperation\	mod
AllPackages	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Census\	mod
EndTime	REG_SZ	2026-10-06T19:16:58.798	old
	REG_SZ	2026-10-21T11:23:48.104	new
RunCounter	REG_DWORD	0x00000006 (6)	old
	REG_DWORD	0x00000007 (7)	new
StartTime	REG_SZ	2026-10-06T19:16:53.532	old
	REG_SZ	2026-10-21T11:23:46.887	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\	mod
SessionIdHigh	REG_DWORD	0x01dd614d (31285581)	old
	REG_DWORD	0x01dd614f (31285583)	new
SessionIdLow	REG_DWORD	0xbdc5fce4 (3183869156)	old
	REG_DWORD	0xd1ae5c5b (3517865051)	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\TiRunning\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\	mod
LastSuccessfulRealtimeUploadTime	REG_QWORD	e7 44 8c c4 4d 61 dd 01 	old
	REG_QWORD	22 a1 a9 36 4f 61 dd 01 	new
LastSuccessfulUploadTime	REG_QWORD	4e 8c e1 06 4e 61 dd 01 	old
	REG_QWORD	22 a1 a9 36 4f 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState\	mod
PolicyState	REG_DWORD	0x00000002 (2)	old
	REG_DWORD	0x00000000 (0)	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\ServiceInstances\77b09393-47d2-42d3-9754-3fb823d3a5c3\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\ServiceInstances\fc30ae55-d78a-4869-ad9c-c3f684bcd6a0\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00006109B10000000100000000F01FEC\Usage\	mod
ProductFiles	REG_DWORD	0x5d470006 (1564934150)	old
	REG_DWORD	0x5d550008 (1565851656)	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InstallService\State\	mod
AutoUpdateLastSuccessTime	REG_SZ	2026-10-06T22:17:48+03:00	old
	REG_SZ	2026-10-21T14:24:16+03:00	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OneSettings\compat\appraiser\	mod
RefreshAfter	REG_QWORD	d0 7c fe d4 2b 56 dd 01 	old
	REG_QWORD	71 63 21 39 b3 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OneSettings\compat\census\	mod
RefreshAfter	REG_QWORD	09 0b bb b7 76 56 dd 01 	old
	REG_QWORD	65 b2 b6 19 fe 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\VFUProvider\	mod
StartTime	REG_QWORD	be de ff 3f 4e 61 dd 01 	old
	REG_QWORD	53 7c 63 c9 4f 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WaaSAssessment\Cache\	mod
01	00	00	00	03	00	00	00	03	00	00	00	ff	ff	ff	ff
															
03	00	00	00	03	00	00	00	ff	ff	ff	ff	03	00	00	00
															
e5	7d	13	42	c7	55	dd	01	9b	56	91	c0	20	0f	d8	01
e4	0f	1c	a4	4e	61										
00	00											 ... (80)
												 ... (80)
OSUpdateAssessment	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\LastOnlineScanTimeForAppCategory\855E8A7C-ECB4-4CA3-B045-1DFA50104289\	mod
00C2490A-EF1D-43C9-BDBA-B84ECC77D2EA	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
06AA027C-C7AA-4CFE-AF76-D1FDA87F376A	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
16DB93BF-8748-449A-96BA-E9ED3A5F872D	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
20F45068-02FC-4701-9385-53AC85D8EAF9	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
214308D7-4262-449D-A78D-9A2306144B11	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
253402B1-6356-4131-B1CD-F4F3B6D2B03C	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
2830B57A-D6C7-4C7A-873E-AD2365CDF2BF	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
2F510DC1-4B62-4128-956E-A73D253CC9CB	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
421BA874-F903-4965-9B82-D60F3BA3CAE0	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
454A759B-FF5B-4A79-80D3-1CF15EBA0908	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
579FC437-D398-411C-A6C5-D01FD4523B94	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
5E19CC61-8994-4797-BDC7-C21263F6282B	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
64293252-5926-453C-9494-2D4021F1C78D	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
64A79953-CF0B-44F9-B5C4-EE5DF3A15C63	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
64B22DF1-5A9C-4C88-AA1F-42CEFAF8B281	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
65B58C5C-5C7E-4B72-9D9F-9BDD15C506B3	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
6C3C7EF3-20FC-43A8-8CE2-1A89F35A1476	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
733893B8-533D-4292-BF27-23D218B39A95	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
7CE6966C-0C33-4851-8958-285ABBA4D7CC	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
7F354D0E-A913-4AA0-815D-3FA9FBFF2BD8	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
86A75D59-8166-4E92-9F46-F3B39784ADA3	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
9607E6E2-46A5-4A17-AFCA-908FFC36D70B	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
9DB724C9-966D-4AEB-9D3B-D6B2C77F3DE3	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
9F03273F-FE0B-4ED8-9BC8-C2F256375490	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
B4F3025D-A236-44B0-8D4C-849BED549259	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
B7757AF6-9E6D-4D21-8272-C9137A2E9145	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
B90F3A9A-C043-41A7-A774-E51F6069283B	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
B99AEF9A-1685-4798-B4B1-3D94EE6D7184	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
BE437D05-6D78-42B6-9BC1-D38C6DE4A43D	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
C9EEB20E-619B-4923-85E1-6017FE8F14A9	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
CD5D53B1-33F7-4A95-B111-F51F187C7130	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
CFC4A10E-0356-451D-BB3E-C4FE5EDFD20C	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
D63C16B5-90E0-4DF5-83AE-8CA6F53997D5	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
DE4F0463-7DB2-48EE-959C-70E02541F4E6	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
E632FE90-A5BA-43AA-BF81-9DE8413E83D8	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
EAAC6C6B-10A4-4659-815B-44F151ECA61A	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
F022389F-F3A6-417E-AD23-704FBDF57117	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
F4CCC4C1-6E9A-49A0-8F19-46F1717C7BA3	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
F855810C-9F77-45FF-A0F5-CD0FEAA945C6	REG_SZ	2026-10-06 19:17:45	old
	REG_SZ	2026-10-21 11:24:11	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RequestedAppCategories\855E8A7C-ECB4-4CA3-B045-1DFA50104289\	mod
00C2490A-EF1D-43C9-BDBA-B84ECC77D2EA	REG_SZ	2026-10-21 11:24:14	add
06AA027C-C7AA-4CFE-AF76-D1FDA87F376A	REG_SZ	2026-10-21 11:24:14	add
16DB93BF-8748-449A-96BA-E9ED3A5F872D	REG_SZ	2026-10-21 11:24:14	add
20F45068-02FC-4701-9385-53AC85D8EAF9	REG_SZ	2026-10-21 11:24:14	add
214308D7-4262-449D-A78D-9A2306144B11	REG_SZ	2026-10-21 11:24:14	add
253402B1-6356-4131-B1CD-F4F3B6D2B03C	REG_SZ	2026-10-21 11:24:14	add
2830B57A-D6C7-4C7A-873E-AD2365CDF2BF	REG_SZ	2026-10-21 11:24:14	add
2F510DC1-4B62-4128-956E-A73D253CC9CB	REG_SZ	2026-10-21 11:24:14	add
421BA874-F903-4965-9B82-D60F3BA3CAE0	REG_SZ	2026-10-21 11:24:14	add
454A759B-FF5B-4A79-80D3-1CF15EBA0908	REG_SZ	2026-10-21 11:24:14	add
579FC437-D398-411C-A6C5-D01FD4523B94	REG_SZ	2026-10-21 11:24:14	add
5E19CC61-8994-4797-BDC7-C21263F6282B	REG_SZ	2026-10-21 11:24:14	add
64293252-5926-453C-9494-2D4021F1C78D	REG_SZ	2026-10-21 11:24:15	add
64A79953-CF0B-44F9-B5C4-EE5DF3A15C63	REG_SZ	2026-10-21 11:24:14	add
64B22DF1-5A9C-4C88-AA1F-42CEFAF8B281	REG_SZ	2026-10-21 11:24:14	add
65B58C5C-5C7E-4B72-9D9F-9BDD15C506B3	REG_SZ	2026-10-21 11:24:14	add
6C3C7EF3-20FC-43A8-8CE2-1A89F35A1476	REG_SZ	2026-10-21 11:24:14	add
733893B8-533D-4292-BF27-23D218B39A95	REG_SZ	2026-10-21 11:24:14	add
7CE6966C-0C33-4851-8958-285ABBA4D7CC	REG_SZ	2026-10-21 11:24:14	add
7F354D0E-A913-4AA0-815D-3FA9FBFF2BD8	REG_SZ	2026-10-21 11:24:14	add
86A75D59-8166-4E92-9F46-F3B39784ADA3	REG_SZ	2026-10-21 11:24:14	add
9607E6E2-46A5-4A17-AFCA-908FFC36D70B	REG_SZ	2026-10-21 11:24:14	add
9DB724C9-966D-4AEB-9D3B-D6B2C77F3DE3	REG_SZ	2026-10-21 11:24:14	add
9F03273F-FE0B-4ED8-9BC8-C2F256375490	REG_SZ	2026-10-21 11:24:14	add
B4F3025D-A236-44B0-8D4C-849BED549259	REG_SZ	2026-10-21 11:24:14	add
B7757AF6-9E6D-4D21-8272-C9137A2E9145	REG_SZ	2026-10-21 11:24:14	add
B90F3A9A-C043-41A7-A774-E51F6069283B	REG_SZ	2026-10-21 11:24:14	add
B99AEF9A-1685-4798-B4B1-3D94EE6D7184	REG_SZ	2026-10-21 11:17:29	old
	REG_SZ	2026-10-21 11:24:14	new
BE437D05-6D78-42B6-9BC1-D38C6DE4A43D	REG_SZ	2026-10-21 11:24:14	add
C9EEB20E-619B-4923-85E1-6017FE8F14A9	REG_SZ	2026-10-21 11:24:14	add
CD5D53B1-33F7-4A95-B111-F51F187C7130	REG_SZ	2026-10-21 11:24:14	add
CFC4A10E-0356-451D-BB3E-C4FE5EDFD20C	REG_SZ	2026-10-21 11:24:14	add
D63C16B5-90E0-4DF5-83AE-8CA6F53997D5	REG_SZ	2026-10-21 11:24:14	add
DE4F0463-7DB2-48EE-959C-70E02541F4E6	REG_SZ	2026-10-21 11:24:14	add
E632FE90-A5BA-43AA-BF81-9DE8413E83D8	REG_SZ	2026-10-21 11:24:14	add
EAAC6C6B-10A4-4659-815B-44F151ECA61A	REG_SZ	2026-10-21 11:17:28	old
	REG_SZ	2026-10-21 11:24:15	new
F022389F-F3A6-417E-AD23-704FBDF57117	REG_SZ	2026-10-21 11:24:14	add
F4CCC4C1-6E9A-49A0-8F19-46F1717C7BA3	REG_SZ	2026-10-21 11:24:14	add
F855810C-9F77-45FF-A0F5-CD0FEAA945C6	REG_SZ	2026-10-21 11:24:14	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\ActiveUpdateSessions\51b519d5-b6f5-4333-8df6-e74d7c9aead4\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\Scheduler\	mod
Cleanup the UsoSession map	REG_QWORD	10 78 34 46 4e 61 dd 01 	old
	REG_QWORD	b0 4b 4f d5 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\UScheduler\IA\	add
cmdLine	REG_SZ	C:\Windows\System32\usoclient.exe	add
pauseArg	REG_SZ	PauseStoreUpdates	add
queuedTime	REG_QWORD	df e5 d3 b4 4e 61 dd 01 	add
startArg	REG_SZ	StartStoreUpdates	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Orchestrator\UScheduler\USO\	del
cmdLine	REG_SZ	C:\Windows\system32\usoclient.exe	del
pauseArg	REG_SZ	PauseScheduleTime	del
queuedTime	REG_QWORD	fd 52 dd c0 4d 61 dd 01 	del
startArg	REG_SZ	StartScheduleTime	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\855E8A7C-ECB4-4CA3-B045-1DFA50104289\	mod
CountryCode	REG_SZ	88	old
	REG_SZ	RU	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\StickyUpdates\	mod
aebdf561-8e37-4e47-bfc0-d8221c8908e0	REG_QWORD	bd 80 a5 b5 4e 61 dd 01 	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{102aab0a-9d9c-4887-a860-55de33b96595}\	mod
MessageFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\NisSrv.exe	new
ParameterFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\NisSrv.exe	new
ResourceFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\NisSrv.exe	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{11cd958a-c507-4ef3-b3f2-5fd9dfbd2c78}\	mod
MessageFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpEvMsg.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpEvMsg.dll	new
ParameterFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpEvMsg.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpEvMsg.dll	new
ResourceFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpEvMsg.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpEvMsg.dll	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{751ef305-6c6e-4fed-b847-02ef79d26aef}\	mod
MessageFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpSvc.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpSvc.dll	new
ParameterFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpSvc.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpSvc.dll	new
ResourceFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpSvc.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpSvc.dll	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{8e92deef-5e17-413b-b927-59b2f06a3cfc}\	mod
MessageFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpRtp.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpRtp.dll	new
ParameterFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpRtp.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpRtp.dll	new
ResourceFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpRtp.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpRtp.dll	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{cfeb0608-330e-4410-b00d-56d8da9986e6}\	mod
MessageFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\Drivers\WdFilter.sys	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\Drivers\WdFilter.sys	new
ParameterFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\Drivers\WdFilter.sys	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\Drivers\WdFilter.sys	new
ResourceFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\Drivers\WdFilter.sys	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\Drivers\WdFilter.sys	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{e4b70372-261f-4c54-8fa6-a5a7914d73da}\	mod
MessageFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpClient.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpClient.dll	new
ParameterFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpClient.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpClient.dll	new
ResourceFileName	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpClient.dll	old
	REG_EXPAND_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpClient.dll	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\ASAPCP\	mod
LastRefreshAttempted	REG_QWORD	b7 16 cb b7 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\CORTANAUWP\	mod
LastRefreshAttempted	REG_QWORD	7b d9 06 b8 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\CTAC\	mod
LastRefreshAttempted	REG_QWORD	44 18 47 b8 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\DXDB\	mod
LastRefreshAttempted	REG_QWORD	af 1a 83 b8 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\FCON\	mod
LastRefreshAttempted	REG_QWORD	3f b8 a8 b8 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\FSS\	mod
LastRefreshAttempted	REG_QWORD	92 de 36 bd 4d 61 dd 01 	old
	REG_QWORD	b7 50 6f a7 4e 61 dd 01 	new
LastRefreshByApp	REG_QWORD	92 de 36 bd 4d 61 dd 01 	old
	REG_QWORD	b7 50 6f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\GAMEINPUT\	mod
LastRefreshAttempted	REG_QWORD	93 dc 11 b9 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\KNOWNGAMELIST\	mod
LastRefreshAttempted	REG_QWORD	40 a3 4f b9 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\MITIGATION\	mod
LastRefreshAttempted	REG_QWORD	d7 d2 9c b9 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\MLMOD\	mod
LastRefreshAttempted	REG_QWORD	4f 7a f7 bb 4d 61 dd 01 	old
	REG_QWORD	fd c3 3f a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\MUSE\	mod
LastRefreshAttempted	REG_QWORD	62 7c 37 bc 4d 61 dd 01 	old
	REG_QWORD	d2 9c 49 a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\SCCINSTALLSVC\	mod
LastRefreshAttempted	REG_QWORD	9f 7a 95 bc 4d 61 dd 01 	old
	REG_QWORD	d2 9c 49 a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\STORAGEGROVELER\	mod
LastRefreshAttempted	REG_QWORD	63 b2 ba bc 4d 61 dd 01 	old
	REG_QWORD	e7 f4 4b a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Wosc\Client\Persistent\ClientState\WOSC\	mod
LastRefreshAttempted	REG_QWORD	4e 62 34 bd 4d 61 dd 01 	old
	REG_QWORD	ca 6d 6a a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\192\	add
CreationTime	REG_QWORD	b2 36 2e 40 4f 61 dd 01 	add
Reason	REG_DWORD	0x00000000 (0)	add
Terminator	REG_SZ	HAM	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\TermReason\7076\	add
CreationTime	REG_QWORD	ca 6a b6 88 4f 61 dd 01 	add
Reason	REG_DWORD	0x00000004 (4)	add
Terminator	REG_SZ	HAM	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\	mod
BackupLocation	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0	new
InstallLocation	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\	new
ServiceStartStates	REG_DWORD	0x00000001 (1)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\CoreService\	mod
WdConfigHash	REG_DWORD	0xa9de7a0c (2849929740)	old
	REG_DWORD	0x5f0909aa (1594427818)	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Diagnostics\	mod
03	00	e0	65	01	00	01	00								
09		ea													
LastKnownGoodEngineCandidate	REG_BINARY		mod
LatestEngineVersionOnDevice	REG_BINARY	09 00 ea 65 01 00 01 00 	add
04	00	e0	65	12	00	04	00								
09		ea													
LatestPlatformVersionOnDevice	REG_BINARY		mod
PlatformHealthData	REG_BINARY	03 00 00 00 30 01 00 00 62 97 2e 8a 04 55 dd 01 6f 8c 00 1e 13 55 dd 01 04 00 00 00 00 00 00 00 04 00 00 00 01 00 00 00 00 00 00 00 02 00 00 00 04 00  ... (304)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\Controls\	mod
297	REG_DWORD	0x00000001 (1)	add
345	REG_DWORD	0x00000001 (1)	add
346	REG_DWORD	0x00000001 (1)	add
54	REG_DWORD	0x00000001 (1)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\SCC\Notification\	mod
c7	e1	f3	ac	4d	61	dd	01								
9b	a0	71	21	4f											
SCCLastImportTime	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\ManagedAgentHooks\	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\	mod
SigUpdateTimestampsSinceLastHB	REG_SZ		old
	REG_SZ	10/21/2026 11:24:45.489985800 UTC;	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\0af068f6c87669992663df31aac55cd7\	add
(Default)	REG_SZ	HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs	add
05cbe3edb63ffb29746e4b651f24d8ba	REG_BINARY	01 00 00 00 60 00 00 00 28 00 00 00 00 00 00 00 34 00 00 00 00 00 00 00 5c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 4d 00 70 00 44 00 65 00 66 00  ... (96)	add
5aa31f8c3df35e059c07b1a0d1bbe1fe	REG_BINARY	01 00 00 00 60 00 00 00 28 00 00 00 00 00 00 00 34 00 00 00 00 00 00 00 5c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 4d 00 70 00 44 00 65 00 66 00  ... (96)	add
6d89d22ea1da260d22e363fbd21b358c	REG_BINARY	01 00 00 00 60 00 00 00 28 00 00 00 00 00 00 00 34 00 00 00 00 00 00 00 5c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 4d 00 70 00 44 00 65 00 66 00  ... (96)	add
81865fc08cd8914d7d0a718fcc50fab0	REG_BINARY	01 00 00 00 60 00 00 00 28 00 00 00 00 00 00 00 34 00 00 00 00 00 00 00 5c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 4d 00 70 00 44 00 65 00 66 00  ... (96)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\0bc0eab08d712fbb0a1a2ffb5f9dc0db\	mod
01	00	00	00	40	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
04	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (64)
												 ... (64)
5826cf6c99d3072cab056b39458d7b9b	REG_BINARY		mod
5d57e48f0b4e965e1cf19cd7a0953139	REG_BINARY	01 00 00 00 44 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (68)	add
01	00	00	00	3e	00	00	00	28	00	00	00	00	00	00	00
				4c											
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
02	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
10															
6c	00											 ... (62)
												 ... (76)
b6b44c195c792c1c193e757b12d34b61	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\37e149a2d699dbdb5d88842f102031bb\	mod
6c80a69b5daf3f4c2b9e88d543d07911	REG_BINARY	01 00 00 00 64 00 00 00 28 00 00 00 00 00 00 00 34 00 00 00 00 00 00 00 5c 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 4d 00 70 00 44 00 65 00 66 00  ... (100)	add
01	00	00	00	64	00	00	00	28	00	00	00	00	00	00	00
															
34	00	00	00	00	00	00	00	5c	00	00	00	00	00	00	00
															
08	00	00	00	00	00	00	00	4d	00	70	00	44	00	65	00
															
66	00											 ... (100)
												 ... (100)
756db267e58a01aa2e96ab3ecaef01ee	REG_BINARY		mod
01	00	00	00	40	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
04	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (64)
												 ... (64)
e6da8ac6c0ea655b1593aacacaf13478	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\43a5c7a9577d9fb23758aeb591160fb9\	mod
4f600903eef1e79b7e2a5180732780d0	REG_BINARY	01 00 00 00 44 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (68)	add
01	00	00	00	4c	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
10	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (76)
												 ... (76)
e280834d83fa795772ba8f5323c9fa03	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\7402669cb25b72911c6eb48a2eb62b12\	add
(Default)	REG_SZ	HKLM\SOFTWARE\Microsoft\Windows Defender\Features\EcsConfigs\ETag	add
8a4cb605b39e0bd5082450b32a910250	REG_BINARY	01 00 00 00 6c 00 00 00 28 00 00 00 00 00 00 00 34 00 00 00 00 00 00 00 5c 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 4d 00 70 00 44 00 65 00 66 00  ... (108)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\7c8aac06d6fa69a5bbc83785c602379a\	mod
c298d8968276cef56372e230923828a1	REG_BINARY	01 00 00 00 4c 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (76)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\7da6a4cae7a6c8687894bf0b2f75656e\	mod
c821f92d1d3558901dbaa7179e7088ef	REG_BINARY	01 00 00 00 44 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (68)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\a3d48adcae854ec91138e049ab8f1667\	mod
1e6f0b1f64f9991b39d26c423314a160	REG_BINARY	01 00 00 00 40 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (64)	del
330840a0a5c68e6f102a6024b7408cfe	REG_BINARY	01 00 00 00 40 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (64)	add
547f98b467fe0aad53af8e2c95d92385	REG_BINARY	01 00 00 00 40 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (64)	add
644e5e96b384bdf35fefc7abfb41f66b	REG_BINARY	01 00 00 00 40 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (64)	add
b7c40b52b1944596f987d954cd319932	REG_BINARY	01 00 00 00 40 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (64)	add
cdc77417143e90b18306436e677e16c4	REG_BINARY	01 00 00 00 40 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (64)	add
f71f5093fc3f7733fc65ef97d3e0a7b3	REG_BINARY	01 00 00 00 40 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (64)	add
f9a197dd2ac21d711bd68bfa77f4ed10	REG_BINARY	01 00 00 00 40 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (64)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\b01784f708f6053209ad4d15d6c83069\	mod
01	00	00	00	44	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
08	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (68)
												 ... (68)
077aff94cd68ac9005e0acd0e798e8cf	REG_BINARY		mod
01	00	00	00	44	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
08	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (68)
												 ... (68)
154cd9ed8dbf3abe19afee82acf42764	REG_BINARY		mod
01	00	00	00	4c	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
10	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (76)
												 ... (76)
214564454a345e80a2a0d243f4d8d83d	REG_BINARY		mod
01	00	00	00	4c	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
10	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (76)
												 ... (76)
26560fa15cbedd1dc6d79280c53311fa	REG_BINARY		mod
01	00	00	00	44	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
08	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (68)
												 ... (68)
34d376f2f99a9376e8cdf5e0fd925bd5	REG_BINARY		mod
01	00	00	00	4a	00	00	00	28	00	00	00	00	00	00	00
															
1a	00	00	00	00	00	00	00	42	00	00	00	00	00	00	00
															
08	00	00	00	00	00	00	00	4d	00	70	00	43	00	6d	00
															
64	00											 ... (74)
												 ... (74)
3b8769df560e8a0188939607b535af16	REG_BINARY		mod
01	00	00	00	44	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
08	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (68)
												 ... (68)
3f2d0b0e74592ed7271369d717d84bc3	REG_BINARY		mod
01	00	00	00	4c	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
10	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (76)
												 ... (76)
56ba5db6eb6bd71d6d4113376e409e49	REG_BINARY		mod
01	00	00	00	4c	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
10	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (76)
												 ... (76)
63ec360384d8974f18d38f03a55e0235	REG_BINARY		mod
01	00	00	00	4c	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
10	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (76)
												 ... (76)
a0b5b24b973e8541e47b99cdfeca1041	REG_BINARY		mod
01	00	00	00	40	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
04	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (64)
												 ... (64)
b875c169455d17b8a5450463f8b08670	REG_BINARY		mod
01	00	00	00	4c	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
10	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (76)
												 ... (76)
d2ce8ce1a0455eaf4f1740961c48675f	REG_BINARY		mod
d314cf694cd0ba04b6a919a6efbb5ace	REG_BINARY	01 00 00 00 44 00 00 00 28 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 08 00 00 00 00 00 00 00 7c 00 4d 00 70 00 43 00 6c 00  ... (68)	add
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Reporting\Notification\de446bbf7b2e7fe9a38f9c5fbcc86eaf\	mod
01	00	00	00	44	00	00	00	28	00	00	00	00	00	00	00
															
14	00	00	00	00	00	00	00	3c	00	00	00	00	00	00	00
															
08	00	00	00	00	00	00	00	7c	00	4d	00	70	00	43	00
															
6c	00											 ... (68)
												 ... (68)
9a632cbbf8facefe9911bdbd44fd4413	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Scan\	mod
0f	20	c4	1b	ee	54	dd	01								
49	a4	99	12	4f	61										
LastAggressiveCheck	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Signature Updates\	mod
00	30	cd	ff	1e	55	dd	01								
80	81	31	eb	60	60										
ASSignatureApplied	REG_BINARY		mod
ASSignatureBaseVersion	REG_SZ	1.459.0.0	old
	REG_SZ	1.461.0.0	new
ASSignatureVersion	REG_SZ	1.459.576.0	old
	REG_SZ	1.461.118.0	new
00	30	cd	ff	1e	55	dd	01								
	eb	98	ea	60	60										
AVSignatureApplied	REG_BINARY		mod
AVSignatureBaseVersion	REG_SZ	1.459.0.0	old
	REG_SZ	1.461.0.0	new
AVSignatureVersion	REG_SZ	1.459.576.0	old
	REG_SZ	1.461.118.0	new
EngineVersion	REG_SZ	1.1.26080.3	old
	REG_SZ	1.1.26090.9	new
77	6d	0c	ad	4d	61	dd	01								
fb	f0	e6	24	4f											
LastFallbackTime	REG_BINARY		mod
c2	01	a4	a0	f8	54	dd	01								
f1	80	82	1c	4f	61										
MoCAMPUpdateStarted	REG_BINARY		mod
d0	07	f2	a1	f8	54	dd	01								
53	22	5b	1e	4f	61										
PlatformLastUpdated	REG_BINARY		mod
SignatureLocation	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{EADDD81B-1BFA-487B-84C0-9245C4886716}	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{328442EF-4412-464A-9E90-9D23EC321F90}	new
5a	7e	05	e8	c6	55	dd	01								
2b	ff	65	c6	4e	61										
SignaturesLastUpdated	REG_BINARY		mod
SignatureUpdateCount	REG_DWORD	0x00000006 (6)	old
	REG_DWORD	0x00000007 (7)	new
01	a5	01	ad	4d	61	dd	01								
d5	31	dd	24	4f											
SignatureUpdateLastAttempted	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Appraiser\RunResults\LastRun\	mod
RunEndTimestamp	REG_QWORD	88 0e ea 42 c7 55 dd 01 	old
	REG_QWORD	10 38 12 a7 4e 61 dd 01 	new
RunStartTimestamp	REG_QWORD	e8 53 ea 3f c7 55 dd 01 	old
	REG_QWORD	56 f7 14 a4 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Appraiser\RunResults\LastSuccessfulRun\	mod
RunEndTimestamp	REG_QWORD	88 0e ea 42 c7 55 dd 01 	old
	REG_QWORD	10 38 12 a7 4e 61 dd 01 	new
RunStartTimestamp	REG_QWORD	e8 53 ea 3f c7 55 dd 01 	old
	REG_QWORD	56 f7 14 a4 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\AvTracking\History\	mod
TimeStamp	REG_QWORD	f1 53 f1 42 c7 55 dd 01 	old
	REG_QWORD	4c 21 17 a7 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\	mod
LastNormalRun	REG_QWORD	43 88 18 3f c7 55 dd 01 	old
	REG_QWORD	99 13 7a a3 4e 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\	mod
4f	00	00	00	02	00	00	00								
51															
41871D20A3BC1475	REG_BINARY		mod
9a	03	00	00	00	00	00	00	04	00	04	00	01	00	06	00
a0															
01	01	00	00	02	12	f8	00	12	6f	ae	00	a5	ad	cf	00
															
cd	ad	05	01	db	b4	ef	00	f1	d9	a3	00	3a	01	02	00
												3f			
00	00											 ... (2436)
												 ... (2464)
418A073AA3BC1C75	REG_BINARY		mod
1a	05	00	00	00	00	00	00	04	00	04	00	01	02	0a	00
3c															
00	00	00	00	2c	00	00	00	0d	78	79	00	10	00	00	00
												14			
59	b5	05	01	02	00	00	00	6b	50	7e	00	02	00	00	00
				03											
81	06											 ... (532)
												 ... (548)
418A073AA3BC3475	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{5D42B99F-5878-41CE-835E-FED8E5FBD3A7}\	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B76A047-5E0D-48D6-97E9-1CB6702F8832}\	mod
03	00	00	00	c6	99	aa	5d	9c	9c	d9	01	09	83	0d	f7
												9b	7c	64	a3
e2	55	dd	01	00	00	00	00	00	00	00	00	d1	f5	14	f7
4e	61											16	32	75	a3
e2	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{15975FEC-F71A-4FF3-9831-53024113DA95}\	mod
03	00	00	00	eb	61	af	5d	9c	9c	d9	01	27	c2	ef	3e
												9b	7c	64	a3
c7	55	dd	01	00	00	00	00	00	00	00	00	19	d5	2b	40
4e	61											a5	d4	1e	a4
c7	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{19051521-1085-4928-B136-FE816BB39A2A}\	mod
85	e6	fb	47	71	20	ce	32	c2	24	09	60	21	39	5f	fd
fc	a3	22	e3		f8	ca	16	ac	ff	19	6b	15	a9	3f	78
fb	c1	dd	0f	2e	b2	e0	d1	e3	f6	21	27	4e	ea	ad	d6
77	f1	24	4c	55	5d	cf	16	a9	8e	24	e6	19	1b	67	18
Hash	REG_BINARY		mod
17	00	00	00	00	00	00	00	00	07	0a	00	00	00	15	00
															
00	48	22	4b	87	61	dd	01	00	07	0a	00	00	00	15	00
80	ae	cd	5e												
ff	ff	ff	ff	ff	ff	ff	ff	80	21	42	42	48	48	48	48
															
e4	9b											 ... (312)
ca	97											 ... (312)
Triggers	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{191384C9-85A1-4EB2-81D4-48F5A0C6ACB7}\	mod
03	00	00	00	ca	bf	b1	5d	9c	9c	d9	01	90	fa	ef	3e
												9b	7c	64	a3
c7	55	dd	01	00	00	00	00	00	00	00	00	e6	99	d4	40
4e	61											5e	b6	2a	a4
c7	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1B813E0C-2BBF-4EFE-9108-D9D020D465F2}\	mod
03	00	00	00	c8	43	4b	5d	9c	9c	d9	01	cd	92	8b	88
												03	ca	01	6c
c7	55	dd	01	00	00	00	00	00	00	00	00	73	07	8e	88
4e	61											8b	24	04	6c
c7	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{28E8AFD1-E750-467F-9311-499474BE8E54}\	mod
03	00	00	00	fb	f5	58	d5	23	55	dd	01	34	d8	12	f7
												7e	b3	6b	a3
e2	55	dd	01	00	00	00	00	00	00	00	00	f6	1d	ab	f7
4e	61											c5		de	a3
e2	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{47B89A79-53D2-485E-AD87-148165B28519}\	mod
03	00	00	00	e7	d5	c4	5d	9c	9c	d9	01	09	83	0d	f7
												9b	7c	64	a3
e2	55	dd	01	00	00	00	00	00	00	00	00	d3	07	17	f7
4e	61											16	32	75	a3
e2	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
d2	40	e4	79	60	67	12	b3	00	04	56	be	19	b2	34	fe
7b	69	69	36	bd	17	dc	93	51	9e	11	30	93	b6	44	83
a0	b2	fe	f4	1d	0f	92	23	5d	ff	0f	ce	cf	72	8e	c2
80	ef	7a	e3	c2	d5	50	da	93	f1	ea	b7	69	a3	2d	
Hash	REG_BINARY		mod
17	00	00	00	00	00	00	00	00	d6	77	3c	b7	00	00	00
									d5	df	48	9b			
00	00	00	00	00	00	00	00	00	07	0a	00	00	00	07	00
														15	
ff	ff	ff	ff	ff	ff	ff	ff	c8	21	42	47	48	48	48	48
															
7f	c4											 ... (417)
9f	a9											 ... (417)
Triggers	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{55412461-F053-4583-A6BF-19F36DAAD46D}\	mod
03	00	00	00	12	22	d3	5d	9c	9c	d9	01	90	fa	ef	3e
												48	a3	3d	c2
c7	55	dd	01	00	00	00	00	00	00	00	00	0b	74	fb	5f
4f	61											37	df	3f	c2
c7	55	dd	01												
4f	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5AAF4FE4-16E1-473F-9A77-69ED05206CCE}\	mod
03	00	00	00	c9	22	78	ce	9c	9c	d9	01	90	fa	ef	3e
												3c	f2	66	a3
c7	55	dd	01	00	00	00	00	00	00	00	00	23	f3	13	3f
4e	61											16	32	75	a3
c7	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
17	00	00	00	00	00	00	00	00	07	06	00	00	00	0c	00
															
80	d1	77	f8	65	9d	d9	01	00	07	06	00	00	00	0c	00
															
ff	ff	ff	ff	ff	ff	ff	ff	c0	21	42	42	48	48	48	48
															
98	76											 ... (304)
												 ... (304)
Triggers	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5BE4947C-EDFF-4961-8577-20E84D4C98CF}\	mod
03	00	00	00	d5	80	6c	9b	bc	9c	d9	01	7f	47	7a	24
												9b	7c	64	a3
4e	61	dd	01	00	00	00	00	02	00	07	80	10	07	6a	af
															
ef	54	dd	01												
															
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{5D42B99F-5878-41CE-835E-FED8E5FBD3A7}\	del
Actions	REG_BINARY	03 00 0c 00 00 00 41 00 75 00 74 00 68 00 6f 00 72 00 66 66 00 00 00 00 46 00 00 00 25 00 73 00 79 00 73 00 74 00 65 00 6d 00 72 00 6f 00 6f 00 74 00  ... (134)	del
DynamicInfo	REG_BINARY	03 00 00 00 b3 44 0d c1 4d 61 dd 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	del
Hash	REG_BINARY	bc a0 49 a9 5e 1f 6a 71 9c 74 69 4a 90 8f d7 67 48 e4 6f e4 2d 01 70 a1 be 49 15 24 36 4d 6e 63 	del
Path	REG_SZ	\Microsoft\Windows\UpdateOrchestrator\AC Power Download	del
Schema	REG_DWORD	0x00010004 (65540)	del
SecurityDescriptor	REG_SZ	D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)	del
Triggers	REG_BINARY	17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff 48 23 42 42 48 48 48 48 38 fc  ... (308)	del
URI	REG_SZ	\Microsoft\Windows\UpdateOrchestrator\AC Power Download	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{6CD70278-3C30-4E8E-A585-8D9E5CAB415F}\	mod
03	00	00	00	e6	54	69	5e	9c	9c	d9	01	b5	2a	c7	fa
												a8		b3	d1
23	55	dd	01	00	00	00	00	00	00	00	00	1a	d7	de	fa
4f	61											cd	e1	b7	d1
23	55	dd	01												
4f	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{786C29A8-A5ED-4933-8EAE-5A1012C6619B}\	mod
03	00	00	00	b1	1a	06	5d	9c	9c	d9	01	4b	38	a5	14
												9b	7c	64	a3
4e	61	dd	01	00	00	00	00	00	00	00	00	75	c0	a9	14
												9a	b7	70	a3
4e	61	dd	01												
															
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7A550ACD-D20D-44ED-B2FA-5CA6FED0BB00}\	mod
03	00	00	00	5f	66	9b	5e	9c	9c	d9	01	90	fa	ef	3e
												3c	f2	66	a3
c7	55	dd	01	00	00	00	00	00	00	00	00	68	23	5a	43
4e	61											59	9a	71	a7
c7	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{7C8034B4-286F-4E86-AD41-4140C28A9604}\	mod
03	00	00	00	2e	97	a2	5e	9c	9c	d9	01	af	3f	3f	33
												3c	f2	66	a3
ed	54	dd	01	00	00	00	00	00	00	00	00	57	18	52	33
4e	61											16	32	75	a3
ed	54	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A6432082-89BD-434D-9C61-D7FE6D91CCB9}\	mod
e6	a9	0a	ba	79	28	c5	8b	0b	42	ef	1e	bc	91	cb	84
ac	c4	3e	aa	a9	12	81	25	0d	78	e0	a7	02	e6	80	75
fd	f4	05	59	1e	95	2b	79	b3	34	86	49	53	2c	fe	7a
6d	88	28	3d	07	4c	54	08	2a	01	14	cc	23	bb	03	0f
Hash	REG_BINARY		mod
17	00	00	00	00	00	00	00	00	07	0a	00	00	00	15	00
															
00	fd	71	5b	5e	61	dd	01	00	07	0a	00	00	00	15	00
80	93	0a	5c												
ff	ff	ff	ff	ff	ff	ff	ff	48	21	c2	02	48	48	48	48
															
8d	84											 ... (320)
80	8c											 ... (320)
Triggers	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AB6A2C2A-DD90-40C7-BCA0-8BD111A95963}\	mod
03	00	00	00	a6	23	5a	5f	9c	9c	d9	01	90	fa	ef	3e
												3c	f2	66	a3
c7	55	dd	01	00	00	00	00	00	00	00	00	a3	46	3c	42
4e	61											c3	5c	42	a4
c7	55	dd	01												
4e	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B7B6F5BC-C2B4-4613-B46A-92A87F9CE858}\	mod
03	00	00	00	31	38	7d	9b	bc	9c	d9	01	90	fa	ef	3e
												3c	f2	66	a3
c7	55	dd	01	00	00	00	00	02	00	07	80	63	27	21	ae
4e	61														
ef	54	dd	01												
															
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E4AEB720-7F18-419F-A20E-6E0B5C4ED968}\	mod
03	00	00	00	a8	72	c5	5f	9c	9c	d9	01	f4	cd	08	91
												17	dc	e8	12
23	55	dd	01	00	00	00	00	00	00	00	00	b1	3f	3d	91
4f	61											e6	5a	11	13
23	55	dd	01												
4f	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FA103B2E-5EB2-499F-9443-9765F29C7B5B}\	mod
03	00	00	00	6d	44	89	5d	9c	9c	d9	01	35	60	b1	fa
												d1	12	a0	d1
23	55	dd	01	00	00	00	00	00	00	00	00	24	c2	f1	fa
4f	61											c1	06	d3	d1
23	55	dd	01												
4f	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{FD99B9AA-26F4-41C8-A511-227192E65CF5}\	mod
03	00	00	00	84	b1	8b	5d	9c	9c	d9	01	46	4b	c2	fa
												77	d8	b1	d1
23	55	dd	01	00	00	00	00	00	00	00	00	b1	65	c9	fa
4f	61											a8	2a	b3	d1
23	55	dd	01												
4f	61														
DynamicInfo	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\AC Power Download\	del
Id	REG_SZ	{5D42B99F-5878-41CE-835E-FED8E5FBD3A7} 	del
Index	REG_DWORD	0x00000003 (3)	del
SD	REG_BINARY	01 00 04 80 74 00 00 00 80 00 00 00 00 00 00 00 14 00 00 00 02 00 60 00 04 00 00 00 00 00 14 00 ff 01 1f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00  ... (140)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance\	mod
01	00	04	80	d8	00	00	00	e4	00	00	00	00	00	00	00
															
14	00	00	00	02	00	c4	00	09	00	00	00	00	00	14	00
															
ff	01	1f	00	01	01	00	00	00	00	00	05	12	00	00	00
															
00	00											 ... (240)
												 ... (240)
SD	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Defender\Windows Defender Cleanup\	mod
01	00	04	80	d8	00	00	00	e4	00	00	00	00	00	00	00
															
14	00	00	00	02	00	c4	00	09	00	00	00	00	00	14	00
															
ff	01	1f	00	01	01	00	00	00	00	00	05	12	00	00	00
															
00	00											 ... (240)
												 ... (240)
SD	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan\	mod
01	00	04	80	d8	00	00	00	e4	00	00	00	00	00	00	00
															
14	00	00	00	02	00	c4	00	09	00	00	00	00	00	14	00
															
ff	01	1f	00	01	01	00	00	00	00	00	05	12	00	00	00
															
00	00											 ... (240)
												 ... (240)
SD	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Windows Defender\Windows Defender Verification\	mod
01	00	04	80	d8	00	00	00	e4	00	00	00	00	00	00	00
															
14	00	00	00	02	00	c4	00	09	00	00	00	00	00	14	00
															
ff	01	1f	00	01	01	00	00	00	00	00	05	12	00	00	00
															
00	00											 ... (240)
												 ... (240)
SD	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\	mod
34	7b	ad	bf	2c	74	27	47	8d	54	dd	6e	1a	8f	80	3c
5c	e9	1d	90	9e	3b	0b	44	9b	df	b9	75	6d	9a	95	75
ServiceSessionId	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Update\TargetingInfo\DynamicInstalled\DefenderSignature.amd64\	mod
Version	REG_SZ	1.459.576.0	old
	REG_SZ	1.461.118.0	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\VolatileNotifications\	mod
41C64E6DA385B855	REG_BINARY	01 00 04 80 44 00 00 00 50 00 00 00 00 00 00 00 14 00 00 00 02 00 30 00 02 00 00 00 00 00 14 00 03 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00  ... (96)	del
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Security Health\	mod
LastHeartbeat	REG_QWORD	d1 44 b4 d7 f8 54 dd 01 	old
	REG_QWORD	23 ed e8 12 4f 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsSelfHost\ClientState\	mod
CurrentCallsPerDayCount	REG_DWORD	0x00000001 (1)	old
	REG_DWORD	0x00000002 (2)	new
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UX\StateVariables\	mod
UpToDateStatusRecalcTimestamp	REG_QWORD	60 e4 d1 1c fc 55 dd 01 	old
	REG_QWORD	d0 45 0f c9 67 61 dd 01 	new
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\NativeMessagingHosts\com.microsoft.defender.browser_extension.native_message_host\	mod
(Default)	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\com.microsoft.defender.be.firefox.json	old
	REG_SZ	C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\com.microsoft.defender.be.firefox.json	new
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\	mod
(Default)	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\X86\MpOav.dll"	old
	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\X86\MpOav.dll"	new
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\SystemCertificates\AuthRoot\AutoUpdate\	mod
6a	9e	25	dc	e2	55	dd	01								
1b	07	01	c8	4e	61										
LastSyncTime	REG_BINARY		mod
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState\	mod
PolicyState	REG_DWORD	0x00000002 (2)	old
	REG_DWORD	0x00000000 (0)	new
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Group Policy\ServiceInstances\77b09393-47d2-42d3-9754-3fb823d3a5c3\	del
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Group Policy\ServiceInstances\fc30ae55-d78a-4869-ad9c-c3f684bcd6a0\	add
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\WMI\Security\	mod
01	00	04	80	14	00	00	00	24	00	00	00	00	00	00	00
															
34	00	00	00	01	02	00	00	00	00	00	05	20	00	00	00
															
20	02	00	00	01	02	00	00	00	00	00	05	20	00	00	00
															
20	02											 ... (564)
												 ... (612)
1fc688a1-d5f3-4cef-a0ee-96b3b35580f0	REG_BINARY		mod
e0acc579-25a4-486c-bdcf-7935281db3fa	REG_BINARY	01 00 04 80 14 00 00 00 24 00 00 00 00 00 00 00 34 00 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02  ... (612)	add
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\bam\State\UserSettings\S-1-5-21-2292890337-69778762-837601055-1001\	mod
b8	ba	3c	f1	c7	55	dd	01	00	00	00	00	00	00	00	00
f1	e3	2c	83	4f	61										
00	00	00	00	02	00	00	00								
															
\Device\HarddiskVolume4\Windows\System32\cmd.exe	REG_BINARY		mod
d5	46	40	e5	4d	61	dd	01	00	00	00	00	00	00	00	00
c6	a6	f1	00	4f											
00	00	00	00	02	00	00	00								
															
\Device\HarddiskVolume4\Windows\System32\EaseOfAccessDialog.exe	REG_BINARY		mod
46	c9	44	3f	c7	55	dd	01	00	00	00	00	00	00	00	00
c6	10	c2	a3	4e	61										
00	00	00	00	02	00	00	00								
															
\Device\HarddiskVolume4\Windows\System32\MusNotificationUx.exe	REG_BINARY		mod
de	27	f4	1e	14	55	dd	01	00	00	00	00	00	00	00	00
5b	0d	89	82	4e	61										
01	00	00	00	02	00	00	00								
															
InputApp_cw5n1h2txyewy	REG_BINARY		mod
af	9c	05	36	24	55	dd	01	00	00	00	00	00	00	00	00
f2	48	17	52	4f	61										
01	00	00	00	02	00	00	00								
															
Microsoft.Windows.SecHealthUI_cw5n1h2txyewy	REG_BINARY		mod
60	6c	b6	5e	24	55	dd	01	00	00	00	00	00	00	00	00
b2	90	09	1c	4f	61										
01	00	00	00	02	00	00	00								
															
Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy	REG_BINARY		mod
SequenceNumber	REG_DWORD	0x00000018 (24)	old
	REG_DWORD	0x0000001c (28)	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\KslD\	mod
DeleteFlag	REG_DWORD	0x00000001 (1)	add
Start	REG_DWORD	0x00000003 (3)	old
	REG_DWORD	0x00000004 (4)	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MDCoreSvc\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-244	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-244	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-245	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-245	new
ImagePath	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpDefenderCoreService.exe"	old
	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpDefenderCoreService.exe"	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Epoch\	mod
Epoch	REG_DWORD	0x000002a4 (676)	old
	REG_DWORD	0x000002a8 (680)	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System\	mod
500a31dc-98f5-4ba6-8f1d-3e8cef524708	REG_SZ	v2.30|Action=Block|Active=TRUE|Dir=In|App=%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe|Svc=WinDefend|Name=Входящее правило ограничения службы для WinDefend|Desc=Блокирует весь входящий трафик для службы WinDefend|	add
6dba16f3-d722-4f77-ac88-fc4838069978	REG_SZ	v2.30|Action=Block|Active=TRUE|Dir=Out|App=%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe|Svc=WinDefend|Name=Исходящее правило ограничения службы для WinDefend|Desc=Блокирует весь исходящий трафик для службы WinDefend|	add
{3AE0D145-5B92-49ED-9543-0FB6728DC4A7}	REG_SZ	v2.30|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|App=%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe|Svc=WinDefend|Name=WinDefend Outbound for TCP|	add
{C89EF481-8F03-4900-A8A8-2E31D4960D17}	REG_SZ	v2.30|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|App=%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe|Svc=WinDefend|Name=WinDefend Outbound for TCP|	del
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits\	mod
SecureTimeEstimated	REG_QWORD	63 9c 7d 60 4e 61 dd 01 	old
	REG_QWORD	4e 78 3d c6 4f 61 dd 01 	new
SecureTimeHigh	REG_QWORD	63 04 42 c2 56 61 dd 01 	old
	REG_QWORD	4e e0 01 28 58 61 dd 01 	new
SecureTimeLow	REG_QWORD	63 34 b9 fe 45 61 dd 01 	old
	REG_QWORD	4e 10 79 64 47 61 dd 01 	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits\RunTime\	mod
SecureTimeTickCount	REG_QWORD	a9 0c 05 00 00 00 00 00 	old
	REG_QWORD	79 34 0e 00 00 00 00 00 	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdAiNisDrv\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-440	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-440	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-430	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-430	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdBoot\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-400	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-400	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-390	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-390	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdFilter\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-340	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-340	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-330	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-330	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-242	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-370	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-370	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-242	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-320	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-320	new
ImagePath	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe"	old
	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\NisSrv.exe"	new
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefend\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-240	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-240	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-310	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-310	new
ImagePath	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe"	old
	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe"	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security\	mod
01	00	04	80	14	00	00	00	24	00	00	00	00	00	00	00
															
34	00	00	00	01	02	00	00	00	00	00	05	20	00	00	00
															
20	02	00	00	01	02	00	00	00	00	00	05	20	00	00	00
															
20	02											 ... (564)
												 ... (612)
1fc688a1-d5f3-4cef-a0ee-96b3b35580f0	REG_BINARY		mod
e0acc579-25a4-486c-bdcf-7935281db3fa	REG_BINARY	01 00 04 80 14 00 00 00 24 00 00 00 00 00 00 00 34 00 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02 00 00 01 02 00 00 00 00 00 05 20 00 00 00 20 02  ... (612)	add
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-2292890337-69778762-837601055-1001\	mod
b8	ba	3c	f1	c7	55	dd	01	00	00	00	00	00	00	00	00
f1	e3	2c	83	4f	61										
00	00	00	00	02	00	00	00								
															
\Device\HarddiskVolume4\Windows\System32\cmd.exe	REG_BINARY		mod
d5	46	40	e5	4d	61	dd	01	00	00	00	00	00	00	00	00
c6	a6	f1	00	4f											
00	00	00	00	02	00	00	00								
															
\Device\HarddiskVolume4\Windows\System32\EaseOfAccessDialog.exe	REG_BINARY		mod
46	c9	44	3f	c7	55	dd	01	00	00	00	00	00	00	00	00
c6	10	c2	a3	4e	61										
00	00	00	00	02	00	00	00								
															
\Device\HarddiskVolume4\Windows\System32\MusNotificationUx.exe	REG_BINARY		mod
de	27	f4	1e	14	55	dd	01	00	00	00	00	00	00	00	00
5b	0d	89	82	4e	61										
01	00	00	00	02	00	00	00								
															
InputApp_cw5n1h2txyewy	REG_BINARY		mod
af	9c	05	36	24	55	dd	01	00	00	00	00	00	00	00	00
f2	48	17	52	4f	61										
01	00	00	00	02	00	00	00								
															
Microsoft.Windows.SecHealthUI_cw5n1h2txyewy	REG_BINARY		mod
60	6c	b6	5e	24	55	dd	01	00	00	00	00	00	00	00	00
b2	90	09	1c	4f	61										
01	00	00	00	02	00	00	00								
															
Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy	REG_BINARY		mod
SequenceNumber	REG_DWORD	0x00000018 (24)	old
	REG_DWORD	0x0000001c (28)	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KslD\	mod
DeleteFlag	REG_DWORD	0x00000001 (1)	add
Start	REG_DWORD	0x00000003 (3)	old
	REG_DWORD	0x00000004 (4)	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MDCoreSvc\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-244	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-244	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-245	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-245	new
ImagePath	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpDefenderCoreService.exe"	old
	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpDefenderCoreService.exe"	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch\	mod
Epoch	REG_DWORD	0x000002a4 (676)	old
	REG_DWORD	0x000002a8 (680)	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System\	mod
500a31dc-98f5-4ba6-8f1d-3e8cef524708	REG_SZ	v2.30|Action=Block|Active=TRUE|Dir=In|App=%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe|Svc=WinDefend|Name=Входящее правило ограничения службы для WinDefend|Desc=Блокирует весь входящий трафик для службы WinDefend|	add
6dba16f3-d722-4f77-ac88-fc4838069978	REG_SZ	v2.30|Action=Block|Active=TRUE|Dir=Out|App=%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe|Svc=WinDefend|Name=Исходящее правило ограничения службы для WinDefend|Desc=Блокирует весь исходящий трафик для службы WinDefend|	add
{3AE0D145-5B92-49ED-9543-0FB6728DC4A7}	REG_SZ	v2.30|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|App=%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe|Svc=WinDefend|Name=WinDefend Outbound for TCP|	add
{C89EF481-8F03-4900-A8A8-2E31D4960D17}	REG_SZ	v2.30|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|App=%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe|Svc=WinDefend|Name=WinDefend Outbound for TCP|	del
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits\	mod
SecureTimeEstimated	REG_QWORD	63 9c 7d 60 4e 61 dd 01 	old
	REG_QWORD	4e 78 3d c6 4f 61 dd 01 	new
SecureTimeHigh	REG_QWORD	63 04 42 c2 56 61 dd 01 	old
	REG_QWORD	4e e0 01 28 58 61 dd 01 	new
SecureTimeLow	REG_QWORD	63 34 b9 fe 45 61 dd 01 	old
	REG_QWORD	4e 10 79 64 47 61 dd 01 	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits\RunTime\	mod
SecureTimeTickCount	REG_QWORD	a9 0c 05 00 00 00 00 00 	old
	REG_QWORD	79 34 0e 00 00 00 00 00 	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdAiNisDrv\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-440	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-440	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-430	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-430	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdBoot\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-400	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-400	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-390	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-390	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdFilter\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-340	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-340	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-330	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-330	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisDrv\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-242	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-370	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-370	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdNisSvc\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-242	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-320	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-320	new
ImagePath	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26080.4-0\NisSrv.exe"	old
	REG_EXPAND_SZ	"%ProgramData%\Microsoft\Windows Defender\Platform\4.18.26090.9-0\NisSrv.exe"	new
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend\	mod
Description	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-240	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-240	new
DisplayName	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MpAsDesc.dll,-310	old
	REG_SZ	@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-310	new
ImagePath	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26080.4-0\MsMpEng.exe"	old
	REG_EXPAND_SZ	"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MsMpEng.exe"	new
HKEY_LOCAL_MACHINE\SYSTEM\RNG\	mod
52	75	6e	6e	69	6e	67	21	00	d0	07	00	bb	b2	2d	ee
												0f	bd	f8	04
2c	57	6f	ec	46	97	1c	b7	e0	04	4e	70	c7	3e	6e	af
0f	73	5e	8e	ef	bc	49	52	f2	ac	77	a6	5a	71	38	1c
e8	3e	fb	9c	38	3a	3b	db	e7	1f	25	ce	32	96	da	98
3c	7a	15	dc	ea	9c	8c	35	8e	dd	77	62	d5	50	6f	fc
3a	2c											 ... (76)
58	d0											 ... (76)
Seed	REG_BINARY		mod
HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\3b\B1A07F78\	mod
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-240	REG_SZ	Позволяет пользователям защититься от вредоносных и иных потенциально нежелательных программ	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	REG_SZ	Позволяет защититься от попыток вторжения, нацеленных на известные и вновь обнаруженные уязвимости в сетевых протоколах	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-244	REG_SZ	Отслеживает доступность, работоспособность и производительность различных компонентов безопасности	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-245	REG_SZ	Основная служба Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-310	REG_SZ	Служба антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-320	REG_SZ	Служба проверки сети антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-330	REG_SZ	Драйвер с функцией мини-фильтра в составе антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-340	REG_SZ	Драйвер с функцией мини-фильтра в составе антивирусной программы Microsoft Defender для защиты от вредоносных программ во время доступа	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-370	REG_SZ	Системный драйвер проверки сети в составе антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-390	REG_SZ	Драйвер загрузки антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-400	REG_SZ	Драйвер загрузки антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-430	REG_SZ	Microsoft WdAiNisDrv Driver	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-440	REG_SZ	Мĩςřōšőƒт Đ℮ƒęńďëŕ Ņèτẃöřķ íйśφêςтîσņ ðŕĭνεг ƒòѓ ĄĨ	add
@C:\Windows\system32\notepad.exe,-469	REG_SZ	Текстовый документ	add
HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property\	mod
01	00	00	00	01	00	00	00	d0	8c	9d	df	01	15	d1	11
															
8c	7a	00	c0	4f	c2	97	eb	01	00	00	00	4c	ad	3b	0f
															
e8	83	8f	4a	b8	39	de	97	b2	b0	29	fa	00	00	00	00
															
02	00											 ... (346)
												 ... (346)
001840196117476E	REG_BINARY		mod
HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{975EE785-95FA-4566-990D-EA4B3D973061}\	mod
01	00	00	00	01	00	00	00	d0	8c	9d	df	01	15	d1	11
															
8c	7a	00	c0	4f	c2	97	eb	01	00	00	00	4c	ad	3b	0f
															
e8	83	8f	4a	b8	39	de	97	b2	b0	29	fa	00	00	00	00
															
02	00											 ... (3290)
												 ... (3290)
DeviceTicket	REG_BINARY		mod
HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{A3D87918-9442-435E-9382-9B170962CAB4}\	mod
01	00	00	00	01	00	00	00	d0	8c	9d	df	01	15	d1	11
															
8c	7a	00	c0	4f	c2	97	eb	01	00	00	00	4c	ad	3b	0f
															
e8	83	8f	4a	b8	39	de	97	b2	b0	29	fa	00	00	00	00
															
02	00											 ... (3290)
												 ... (3290)
DeviceTicket	REG_BINARY		mod
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Microsoft.Windows.PushToInstall\	mod
channelCreation	REG_SZ	134357878136563482	old
	REG_SZ	134370554269164287	new
channelExpiry	REG_SZ	134383798170000000	old
	REG_SZ	134396474270000000	new
channelUri	REG_SZ	瑨灴㩳⼯湷㉳愭㍭⹰潮楴祦眮湩潤獷挮浯㼯潴敫㵮睁䅙䅁允汰汪灋湓樴敆橸奍䉏牥歳奧晍汩䵲婁浡噖㡈ㄵ獑慤㑴扳敌䵱噲歒昳䥁䑗〷偣楦吹䱈煆㘶㕌癰祹畤牢獅㈱㍕䍢歖䝹捲瘰㍬㍣硏呦硚═昲漷䩆偅㑤䕇䠷╷搳	old
	REG_SZ	瑨灴㩳⼯湷㉳愭㍭⹰潮楴祦眮湩潤獷挮浯㼯潴敫㵮睁䅙䅁䩂╒戲䝱瘳䡓潗瀰〱偫楪㑲坤㝏㍣煤均娱㍦祶䑬㑕流㈥慢㈥䉢乤慇䙂㈥ㅦ╭昲畵乓䭉奕儹煄湘畊ㄶ䭦㝈䥎条改╗戲煄㡩噰潔扢改奆硇㍈橍晭㕬挲㈥祦㐶䩚㍕㙲癡㝸╧搳	new
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Search\	mod
InstalledPackagedAppsRevision	REG_SZ	{BAF74BAE-5193-4E2F-B7DD-E61F2D66EC6A}	old
	REG_SZ	{C8CD9BF5-0CB6-429E-8FB2-3102099A95F4}	new
HKEY_USERS\S-1-5-18\Software\Classes\Local Settings\MuiCache\3b\B1A07F78\	mod
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-240	REG_SZ	Позволяет пользователям защититься от вредоносных и иных потенциально нежелательных программ	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	REG_SZ	Позволяет защититься от попыток вторжения, нацеленных на известные и вновь обнаруженные уязвимости в сетевых протоколах	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-244	REG_SZ	Отслеживает доступность, работоспособность и производительность различных компонентов безопасности	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-245	REG_SZ	Основная служба Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-310	REG_SZ	Служба антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-320	REG_SZ	Служба проверки сети антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-330	REG_SZ	Драйвер с функцией мини-фильтра в составе антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-340	REG_SZ	Драйвер с функцией мини-фильтра в составе антивирусной программы Microsoft Defender для защиты от вредоносных программ во время доступа	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-370	REG_SZ	Системный драйвер проверки сети в составе антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-390	REG_SZ	Драйвер загрузки антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-400	REG_SZ	Драйвер загрузки антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-430	REG_SZ	Microsoft WdAiNisDrv Driver	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-440	REG_SZ	Мĩςřōšőƒт Đ℮ƒęńďëŕ Ņèτẃöřķ íйśφêςтîσņ ðŕĭνεг ƒòѓ ĄĨ	add
@C:\Windows\system32\notepad.exe,-469	REG_SZ	Текстовый документ	add
HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\Immersive\production\Property\	mod
01	00	00	00	01	00	00	00	d0	8c	9d	df	01	15	d1	11
															
8c	7a	00	c0	4f	c2	97	eb	01	00	00	00	4c	ad	3b	0f
															
e8	83	8f	4a	b8	39	de	97	b2	b0	29	fa	00	00	00	00
															
02	00											 ... (346)
												 ... (346)
001840196117476E	REG_BINARY		mod
HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\Immersive\production\Token\{975EE785-95FA-4566-990D-EA4B3D973061}\	mod
01	00	00	00	01	00	00	00	d0	8c	9d	df	01	15	d1	11
															
8c	7a	00	c0	4f	c2	97	eb	01	00	00	00	4c	ad	3b	0f
															
e8	83	8f	4a	b8	39	de	97	b2	b0	29	fa	00	00	00	00
															
02	00											 ... (3290)
												 ... (3290)
DeviceTicket	REG_BINARY		mod
HKEY_USERS\S-1-5-18\Software\Microsoft\IdentityCRL\Immersive\production\Token\{A3D87918-9442-435E-9382-9B170962CAB4}\	mod
01	00	00	00	01	00	00	00	d0	8c	9d	df	01	15	d1	11
															
8c	7a	00	c0	4f	c2	97	eb	01	00	00	00	4c	ad	3b	0f
															
e8	83	8f	4a	b8	39	de	97	b2	b0	29	fa	00	00	00	00
															
02	00											 ... (3290)
												 ... (3290)
DeviceTicket	REG_BINARY		mod
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Microsoft.Windows.PushToInstall\	mod
channelCreation	REG_SZ	134357878136563482	old
	REG_SZ	134370554269164287	new
channelExpiry	REG_SZ	134383798170000000	old
	REG_SZ	134396474270000000	new
channelUri	REG_SZ	瑨灴㩳⼯湷㉳愭㍭⹰潮楴祦眮湩潤獷挮浯㼯潴敫㵮睁䅙䅁允汰汪灋湓樴敆橸奍䉏牥歳奧晍汩䵲婁浡噖㡈ㄵ獑慤㑴扳敌䵱噲歒昳䥁䑗〷偣楦吹䱈煆㘶㕌癰祹畤牢獅㈱㍕䍢歖䝹捲瘰㍬㍣硏呦硚═昲漷䩆偅㑤䕇䠷╷搳	old
	REG_SZ	瑨灴㩳⼯湷㉳愭㍭⹰潮楴祦眮湩潤獷挮浯㼯潴敫㵮睁䅙䅁䩂╒戲䝱瘳䡓潗瀰〱偫楪㑲坤㝏㍣煤均娱㍦祶䑬㑕流㈥慢㈥䉢乤慇䙂㈥ㅦ╭昲畵乓䭉奕儹煄湘畊ㄶ䭦㝈䥎条改╗戲煄㡩噰潔扢改奆硇㍈橍晭㕬挲㈥祦㐶䩚㍕㙲癡㝸╧搳	new
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Search\	mod
InstalledPackagedAppsRevision	REG_SZ	{BAF74BAE-5193-4E2F-B7DD-E61F2D66EC6A}	old
	REG_SZ	{C8CD9BF5-0CB6-429E-8FB2-3102099A95F4}	new
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\	mod
DownlinkBps	REG_DWORD	0x000079ac (31148)	old
	REG_DWORD	0x0000035b (859)	new
DownloadMonthlyCdnBytes	REG_QWORD	8f 62 f3 56 00 00 00 00 	old
	REG_QWORD	cf ee 76 59 00 00 00 00 	new
DownloadMonthlyRateBkBps	REG_QWORD	11 d3 00 00 00 00 00 00 	old
	REG_QWORD	03 00 00 00 00 00 00 00 	new
NormalDownloadCount	REG_DWORD	0x00000002 (2)	old
	REG_DWORD	0x00000000 (0)	new
SwarmCount	REG_DWORD	0x00000004 (4)	old
	REG_DWORD	0x00000002 (2)	new
UplinkBps	REG_DWORD	0x000001c3 (451)	old
	REG_DWORD	0x000004cd (1229)	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\MuiCache\3b\B1A07F78\	mod
@%SystemRoot%\System32\acppage.dll,-6006	REG_SZ	Совместимость программ	add
@%systemroot%\system32\rshx32.DLL,-59	REG_SZ	Редактор прав доступа к файлам и папкам	add
@%systemroot%\system32\SecurityHealthAgent.dll,-12001	REG_SZ	Безопасность Windows	add
@%SystemRoot%\System32\urlmon.dll,-4200	REG_SZ	Открытие файла - предупреждение системы безопасности	add
@C:\Program Files\Common Files\Microsoft Shared\Office16\oregres.dll,-120	REG_SZ	Документ Microsoft Word 97–2003	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-240	REG_SZ	Позволяет пользователям защититься от вредоносных и иных потенциально нежелательных программ	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	REG_SZ	Позволяет защититься от попыток вторжения, нацеленных на известные и вновь обнаруженные уязвимости в сетевых протоколах	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-244	REG_SZ	Отслеживает доступность, работоспособность и производительность различных компонентов безопасности	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-340	REG_SZ	Драйвер с функцией мини-фильтра в составе антивирусной программы Microsoft Defender для защиты от вредоносных программ во время доступа	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-400	REG_SZ	Драйвер загрузки антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-440	REG_SZ	Мĩςřōšőƒт Đ℮ƒęńďëŕ Ņèτẃöřķ íйśφêςтîσņ ðŕĭνεг ƒòѓ ĄĨ	add
@C:\Windows\system32\ieframe.dll,-5723	REG_SZ	Интернет	add
@C:\Windows\system32\SecurityHealthAgent.dll,-12001	REG_SZ	Безопасность Windows	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\InputApp_cw5n1h2txyewy\HAM\AUI\App\V1\LU\	mod
ICT	REG_QWORD	4e bc c4 32 08 55 dd 01 	old
	REG_QWORD	a5 dc 8d 82 4e 61 dd 01 	new
ITT	REG_QWORD	9e b8 d8 32 08 55 dd 01 	old
	REG_QWORD	79 53 a3 82 4e 61 dd 01 	new
PCT	REG_QWORD	5c 1a ae 32 08 55 dd 01 	old
	REG_QWORD	76 bf 7a 82 4e 61 dd 01 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\HAM\AUI\App\V1\LU\	mod
PCT	REG_QWORD	69 ca 68 d8 4d 61 dd 01 	old
	REG_QWORD	80 ab e4 64 4f 61 dd 01 	new
PTT	REG_QWORD	69 75 a9 fc 4d 61 dd 01 	old
	REG_QWORD	ca 6a b6 88 4f 61 dd 01 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\HAM\AUI\SecHealthUI\V1\LU\	mod
ICT	REG_QWORD	2b c5 6c 14 24 55 dd 01 	old
	REG_QWORD	fc 8b 8d 20 4f 61 dd 01 	new
ITT	REG_QWORD	37 b7 0e 24 24 55 dd 01 	old
	REG_QWORD	16 f1 27 40 4f 61 dd 01 	new
PCT	REG_QWORD	39 ce 88 0e 24 55 dd 01 	old
	REG_QWORD	64 64 75 20 4f 61 dd 01 	new
PTT	REG_QWORD	45 0f 22 24 24 55 dd 01 	old
	REG_QWORD	5b 9b 30 40 4f 61 dd 01 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1\LU\	mod
ICT	REG_QWORD	c6 87 f5 0c 24 55 dd 01 	old
	REG_QWORD	71 a4 9b 25 4f 61 dd 01 	new
ITT	REG_QWORD	c2 be 9b 0e 24 55 dd 01 	old
	REG_QWORD	75 ef da 29 4f 61 dd 01 	new
PCT	REG_QWORD	03 c3 4f 08 24 55 dd 01 	old
	REG_QWORD	37 3e ed 1b 4f 61 dd 01 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\	mod
05	00	00	00	09	00	00	00	00	00	00	00	01	00	00	00
01								05				00			
06	00	00	00	08	00	00	00	07	00	00	00	02	00	00	00
															
04	00	00	00	03	00	00	00	ff	ff	ff	ff				
															
MRUListEx	REG_BINARY		mod
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02											 ... (94)
												 ... (96)
NodeSlots	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\	mod
03	00	00	00	02	00	00	00	01	00	00	00	04	00	00	00
01				03				02							
00	00	00	00	ff	ff	ff	ff								
															
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\	mod
5	REG_BINARY	66 00 31 00 00 00 00 00 cc 56 7d 66 10 00 50 52 4f 43 45 53 7e 31 00 00 4e 00 09 00 04 00 ef be cc 56 7c 66 55 5d 87 5a 2e 00 00 00 96 a2 01 00 00 00  ... (104)	add
01	00	00	00	03	00	00	00	04	00	00	00	02	00	00	00
05				01				03				04			
00	00	00	00	ff	ff	ff	ff								
02				00	00	00	00	ff	ff	ff	ff				
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\5\	add
MRUListEx	REG_BINARY	ff ff ff ff 	add
NodeSlot	REG_DWORD	0x0000005f (95)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\	mod
1	REG_BINARY	56 00 31 00 00 00 00 00 45 5d 14 99 10 00 72 65 73 75 6c 74 73 00 40 00 09 00 04 00 ef be 45 5d 14 99 55 5d b8 5a 2e 00 00 00 e9 64 01 00 00 00 09 00  ... (88)	add
00	00	00	00	ff	ff	ff	ff								
01				00	00	00	00	ff	ff	ff	ff				
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\1\	add
MRUListEx	REG_BINARY	ff ff ff ff 	add
NodeSlot	REG_DWORD	0x00000060 (96)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\9\	mod
02	00	00	00	01	00	00	00	00	00	00	00	ff	ff	ff	ff
01				02											
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\	add
ColInfo	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1  ... (136)	add
FFlags	REG_DWORD	0x00000001 (1)	add
GroupByDirection	REG_DWORD	0x00000001 (1)	add
GroupByKey:FMTID	REG_SZ	{00000000-0000-0000-0000-000000000000}	add
GroupByKey:PID	REG_DWORD	0x00000000 (0)	add
GroupView	REG_DWORD	0x00000000 (0)	add
IconSize	REG_DWORD	0x00000010 (16)	add
LogicalViewMode	REG_DWORD	0x00000001 (1)	add
Mode	REG_DWORD	0x00000004 (4)	add
Sort	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\Shell\	add
SniffedFolderType	REG_SZ	Generic	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\ComDlg\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\	add
ColInfo	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1  ... (136)	add
FFlags	REG_DWORD	0x00000001 (1)	add
GroupByDirection	REG_DWORD	0x00000001 (1)	add
GroupByKey:FMTID	REG_SZ	{00000000-0000-0000-0000-000000000000}	add
GroupByKey:PID	REG_DWORD	0x00000000 (0)	add
GroupView	REG_DWORD	0x00000000 (0)	add
IconSize	REG_DWORD	0x00000010 (16)	add
LogicalViewMode	REG_DWORD	0x00000001 (1)	add
Mode	REG_DWORD	0x00000004 (4)	add
Sort	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\Shell\	add
SniffedFolderType	REG_SZ	Generic	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\	mod
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe.ApplicationCompany	REG_SZ	ThinPrint AG	add
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe.FriendlyAppName	REG_SZ	TPVCGateway Service	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\SOFTWARE\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\SOFTWARE\Microsoft\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Speech_OneCore\Isolated\uupqqycGhsoAh3A_O_fwA7YmV9JixZAKWWRFGHsHE30\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\	add
DefaultTokenId	REG_SZ	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\ActivityDataModel\ReaderRevisionInfo\	mod
2259DE09-A10D-947E-641F-56694FF2531D	REG_MULTI_SZ	1㌷10੻†∠慄慴慢敳湉瑳湡散摉•›㤵ㄶⰶ †匢煥敵据≥㨠㌠ㄸⰰ †愢瑣癩瑩卹潴敲摉•›㈢㔲䐹ぅⴹㅁ䐰㤭㜴ⵅ㐶䘱㔭㘶㐹䙆㔲ㄳ≄ਬ†∠楦瑬牥•›੻†††椢剳慥䙤汩整≲㨠〠ਬ†††漢楲楧䙮汩整䭲祥•›ⰰ ††∠瑳瑡䙥汩整䭲祥•›ⰰ ††∠獵牥捁楴湯瑓瑡䙥汩整≲㨠〠 †੽੽	old
	REG_MULTI_SZ	1㌷10੻†∠慄慴慢敳湉瑳湡散摉•›㤵ㄶⰶ †匢煥敵据≥㨠㌠㜸ⰲ †愢瑣癩瑩卹潴敲摉•›㈢㔲䐹ぅⴹㅁ䐰㤭㜴ⵅ㐶䘱㔭㘶㐹䙆㔲ㄳ≄ਬ†∠楦瑬牥•›੻†††椢剳慥䙤汩整≲㨠〠ਬ†††漢楲楧䙮汩整䭲祥•›ⰰ ††∠瑳瑡䙥汩整䭲祥•›ⰰ ††∠獵牥捁楴湯瑓瑡䙥汩整≲㨠〠 †੽੽	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\GlobalSettings\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\CIDSave\Modules\GlobalSettings\ProperTreeModuleInner\	add
ProperTreeModuleInner	REG_BINARY	9c 00 00 00 98 00 00 00 31 53 50 53 05 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 3b 00 00 00 2a 00 00 00 00 4e 00 61 00 76 00 50 00 61 00 6e 00 65  ... (160)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\CIDSizeMRU\	mod
3	REG_BINARY	50 00 72 00 6f 00 63 00 6d 00 6f 00 6e 00 36 00 34 00 2e 00 65 00 78 00 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ... (592)	add
02	00	00	00	01	00	00	00	00	00	00	00	ff	ff	ff	ff
03				02				01				00	00	00	00
															
ff	ff	ff	ff												
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU\	mod
3	REG_BINARY	50 00 72 00 6f 00 63 00 6d 00 6f 00 6e 00 36 00 34 00 2e 00 65 00 78 00 65 00 00 00 14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00  ... (234)	add
01	00	00	00	02	00	00	00	00	00	00	00	ff	ff	ff	ff
03				01				02				00	00	00	00
															
ff	ff	ff	ff												
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\	mod
3	REG_BINARY	14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 2e 80 3a cc bf b4 2c db 4c 42 b0 29 7f e9 9a 87 c6 41 4e 00 31 00 00 00 00 00 45 5d  ... (304)	add
02	00	00	00	01	00	00	00	00	00	00	00	ff	ff	ff	ff
03				02				01				00	00	00	00
															
ff	ff	ff	ff												
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\PML\	add
0	REG_BINARY	14 00 1f 50 e0 4f d0 20 ea 3a 69 10 a2 d8 08 00 2b 30 30 9d 14 00 2e 80 3a cc bf b4 2c db 4c 42 b0 29 7f e9 9a 87 c6 41 4e 00 31 00 00 00 00 00 45 5d  ... (304)	add
MRUListEx	REG_BINARY	00 00 00 00 ff ff ff ff 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppSwitched\	mod
C:\Users\user\Desktop\tools\ProcessMonitor\Procmon64.exe	REG_DWORD	0x00000001 (1)	add
C:\Users\user\Desktop\tools\SysTracer x64\SysTracer.exe	REG_DWORD	0x00000002 (2)	old
	REG_DWORD	0x00000004 (4)	new
Microsoft.Windows.Explorer	REG_DWORD	0x0000001a (26)	old
	REG_DWORD	0x0000001e (30)	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\OpenWithList\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PML\OpenWithProgids\	add
ProcMon.Logfile.1	REG_NONE		add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\	mod
3f	00	74	00	68	00	72	00	65	00	61	00	74	00	49	00
75		70		64		61		74		65		2f		00	
64	00	3d	00	32	00	31	00	34	00	37	00	36	00	38	00
96		32		00		00		00		00		00		77	69
35	00	31	00	38	00	30	00	00	00	de	00	32	00	00	00
6e	64	6f	77	73	64	65	66	65	6e	64	65	72	2d	2d	75
00	00											 ... (266)
70	64											 ... (168)
0	REG_BINARY		mod
45	REG_BINARY	75 00 70 00 64 00 61 00 74 00 65 00 2f 00 00 00 96 00 32 00 00 00 00 00 00 00 00 00 00 00 77 69 6e 64 6f 77 73 64 65 66 65 6e 64 65 72 2d 2d 75 70 64  ... (168)	add
46	REG_BINARY	4c 00 6f 00 67 00 66 00 69 00 6c 00 65 00 2e 00 50 00 4d 00 4c 00 00 00 6e 00 32 00 00 00 00 00 00 00 00 00 00 00 4c 6f 67 66 69 6c 65 2e 50 4d 4c 2e  ... (136)	add
2c	00	00	00	01	00	00	00	2b	00	00	00	2a	00	00	00
25				2e				01				2d			
29	00	00	00	23	00	00	00	00	00	00	00	1e	00	00	00
24				2c				2b				2a			
28	00	00	00	27	00	00	00	26	00	00	00	18	00	00	00
29				23				00				1e			
1d	00											 ... (184)
28												 ... (192)
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.PML\	add
0	REG_BINARY	4c 00 6f 00 67 00 66 00 69 00 6c 00 65 00 2e 00 50 00 4d 00 4c 00 00 00 6e 00 32 00 00 00 00 00 00 00 00 00 00 00 4c 6f 67 66 69 6c 65 2e 50 4d 4c 2e  ... (136)	add
MRUListEx	REG_BINARY	00 00 00 00 ff ff ff ff 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\Folder\	mod
13	REG_BINARY	72 00 65 00 73 00 75 00 6c 00 74 00 73 00 00 00 62 00 32 00 00 00 00 00 00 00 00 00 00 00 72 65 73 75 6c 74 73 2e 6c 6e 6b 00 48 00 09 00 04 00 ef be  ... (116)	add
00	00	00	00	0c	00	00	00	0b	00	00	00	0a	00	00	00
0d				00				0c				0b			
09	00	00	00	08	00	00	00	01	00	00	00	07	00	00	00
0a				09				08				01			
06	00	00	00	03	00	00	00	04	00	00	00	05	00	00	00
07				06				03				04			
02	00											 ... (56)
05												 ... (60)
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000300B2\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000003049A\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000003055C\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 f4 2b 57 86 13 7d b8 4a 8c a2 6e 91 4a b7 09 bc 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000305E6\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000030614\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000003061A\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000004045A\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000502F0\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000005057E\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000604DA\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060594\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000605D6\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000070452\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000007047C\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000007057E\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000080460\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000805E6\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000090460\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000904DA\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B02DC\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000B047C\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C01E6\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\WRT:Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!SecHealthUI+1+0000000000040582\	add
VirtualDesktop	REG_BINARY	10 00 00 00 30 30 44 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count\	mod
00	00	00	00	29	01	00	00	fb	02	00	00	25	65	3d	01
				2a				0a	03			5f	3c	47	
42	00	00	00	33	00	00	00	08	85	0f	00	7b	00	31	00
															
41	00	43	00	31	00	34	00	45	00	37	00	37	00	2d	00
															
30	00											 ... (1612)
												 ... (1612)
HRZR_PGYFRFFVBA	REG_BINARY		mod
00	00	00	00	03	00	00	00	05	00	00	00	34	e3	02	00
								09				e3	31	06	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
P:\Hfref\hfre\Qrfxgbc\gbbyf\CebprffZbavgbe\Cebpzba64.rkr	REG_BINARY		mod
00	00	00	00	04	00	00	00	07	00	00	00	cb	da	01	00
								08				ad	1a	03	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
P:\Hfref\hfre\Qrfxgbc\gbbyf\FlfGenpre k64\FlfGenpre.rkr	REG_BINARY		mod
P:\Hfref\hfre\Qrfxgbc\yno1\fep\TerlRaretlQebccre.rkr	REG_BINARY	00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00 80 bf 00 00  ... (72)	add
00	00	00	00	05	00	00	00	0a	00	00	00	83	ec	03	00
				06				0c				ec	89	04	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
Zvpebfbsg.Jvaqbjf.FrpUrnyguHV_pj5a1u2gklrjl!FrpUrnyguHV	REG_BINARY		mod
00	00	00	00	00	00	00	00	07	00	00	00	ce	d8	00	00
												a3	da		
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
Zvpebfbsg.Jvaqbjf.FuryyRkcrevraprUbfg_pj5a1u2gklrjl!Ncc	REG_BINARY		mod
00	00	00	00	31	00	00	00	e9	00	00	00	7b	8b	63	00
								f0				4b	95	67	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
Zvpebfbsg.Jvaqbjf.Rkcybere	REG_BINARY		mod
00	00	00	00	00	00	00	00	01	00	00	00	73	7c	00	00
								02				0e	1c	01	
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00	80	bf	00	00	80	bf	00	00	80	bf	00	00	80	bf
															
00	00											 ... (72)
												 ... (72)
{1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\RnfrBsNpprffQvnybt.rkr	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState\	mod
PolicyState	REG_DWORD	0x00000002 (2)	old
	REG_DWORD	0x00000000 (0)	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\InstallService\State\	mod
AutoUpdateLastSuccessTime	REG_SZ	2026-10-06T22:17:48+03:00	old
	REG_SZ	2026-10-21T14:24:16+03:00	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012026100520261006\	del
CacheLimit	REG_DWORD	0x00000001 (1)	del
CacheOptions	REG_DWORD	0x0000000b (11)	del
CachePath	REG_SZ	C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026100520261006	del
CachePrefix	REG_SZ	:2026100520261006: 	del
CacheRelativePath	REG_SZ	Microsoft\Windows\History\History.IE5\MSHist012026100520261006	del
CacheRepair	REG_DWORD	0x00000000 (0)	del
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012026100520261012\	add
CacheLimit	REG_DWORD	0x00000001 (1)	add
CacheOptions	REG_DWORD	0x0000000b (11)	add
CachePath	REG_SZ	C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026100520261012	add
CachePrefix	REG_SZ	:2026100520261012: 	add
CacheRelativePath	REG_SZ	Microsoft\Windows\History\History.IE5\MSHist012026100520261012	add
CacheRepair	REG_DWORD	0x00000000 (0)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012026100620261007\	del
CacheLimit	REG_DWORD	0x00000001 (1)	del
CacheOptions	REG_DWORD	0x0000000b (11)	del
CachePath	REG_SZ	C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026100620261007	del
CachePrefix	REG_SZ	:2026100620261007: 	del
CacheRelativePath	REG_SZ	Microsoft\Windows\History\History.IE5\MSHist012026100620261007	del
CacheRepair	REG_DWORD	0x00000000 (0)	del
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012026102120261022\	add
CacheLimit	REG_DWORD	0x00000001 (1)	add
CacheOptions	REG_DWORD	0x0000000b (11)	add
CachePath	REG_SZ	C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012026102120261022	add
CachePrefix	REG_SZ	:2026102120261022: 	add
CacheRelativePath	REG_SZ	Microsoft\Windows\History\History.IE5\MSHist012026102120261022	add
CacheRepair	REG_DWORD	0x00000000 (0)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\	mod
95	dc	c3	6a	00	00	00	00								
91	a1	d8													
QuietHoursTelemetryLastRun	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Search\JumplistData\	add
C:\Users\user\Desktop\tools\ProcessMonitor\Procmon64.exe	REG_QWORD	b5 6d 8e ba 4f 61 dd 01 	add
Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!SecHealthUI	REG_QWORD	1f e8 d2 24 4f 61 dd 01 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.100\	mod
23	00	41	00	43	00	42	00	6c	00	6f	00	62	00	00	00
															
00	00	00	00	00	00	00	00	01	00	00	00	00	00	00	00
												74		65	
00	00	00	00												
6d															
CheckSetting	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{E8433B72-5842-4d43-8645-BC2C35960837}.check.102\	mod
23	00	41	00	43	00	42	00	6c	00	6f	00	62	00	00	00
															
00	00	00	00	00	00	00	00	01	00	00	00	00	00	00	00
												74		65	
00	00	00	00												
6d															
CheckSetting	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\	mod
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe	REG_BINARY	53 41 43 50 01 00 00 00 00 00 00 00 07 00 00 00 28 00 00 00 78 63 03 00 d7 ea 03 00 01 00 00 00 00 00 00 00 00 00 01 06 71 00 00 00 63 1f 6e 6f 0e de  ... (108)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows NT\CurrentVersion\HostActivityManager\CommitHistory\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!SecHealthUI\	mod
Mixed	REG_QWORD	00 00 ca 03 00 00 00 00 	old
	REG_QWORD	00 00 c5 03 00 00 00 00 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Microsoft\Windows NT\CurrentVersion\HostActivityManager\Volatile\	mod
Microsoft.Windows.SecHealthUI_cw5n1h2txyewy!SecHealthUI	REG_DWORD	0x00000100 (256)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001\Software\Sysinternals\Process Monitor\	mod
SaveDialog	REG_BINARY	2c 00 00 00 00 00 00 00 01 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 58 00 00 00 75 00 00 00 38 02 00 00 06 02 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\MuiCache\3b\B1A07F78\	mod
@%SystemRoot%\System32\acppage.dll,-6006	REG_SZ	Совместимость программ	add
@%systemroot%\system32\rshx32.DLL,-59	REG_SZ	Редактор прав доступа к файлам и папкам	add
@%systemroot%\system32\SecurityHealthAgent.dll,-12001	REG_SZ	Безопасность Windows	add
@%SystemRoot%\System32\urlmon.dll,-4200	REG_SZ	Открытие файла - предупреждение системы безопасности	add
@C:\Program Files\Common Files\Microsoft Shared\Office16\oregres.dll,-120	REG_SZ	Документ Microsoft Word 97–2003	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-240	REG_SZ	Позволяет пользователям защититься от вредоносных и иных потенциально нежелательных программ	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-242	REG_SZ	Позволяет защититься от попыток вторжения, нацеленных на известные и вновь обнаруженные уязвимости в сетевых протоколах	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-244	REG_SZ	Отслеживает доступность, работоспособность и производительность различных компонентов безопасности	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-340	REG_SZ	Драйвер с функцией мини-фильтра в составе антивирусной программы Microsoft Defender для защиты от вредоносных программ во время доступа	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-400	REG_SZ	Драйвер загрузки антивирусной программы Microsoft Defender	add
@C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26090.9-0\MpAsDesc.dll,-440	REG_SZ	Мĩςřōšőƒт Đ℮ƒęńďëŕ Ņèτẃöřķ íйśφêςтîσņ ðŕĭνεг ƒòѓ ĄĨ	add
@C:\Windows\system32\ieframe.dll,-5723	REG_SZ	Интернет	add
@C:\Windows\system32\SecurityHealthAgent.dll,-12001	REG_SZ	Безопасность Windows	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\InputApp_cw5n1h2txyewy\HAM\AUI\App\V1\LU\	mod
ICT	REG_QWORD	4e bc c4 32 08 55 dd 01 	old
	REG_QWORD	a5 dc 8d 82 4e 61 dd 01 	new
ITT	REG_QWORD	9e b8 d8 32 08 55 dd 01 	old
	REG_QWORD	79 53 a3 82 4e 61 dd 01 	new
PCT	REG_QWORD	5c 1a ae 32 08 55 dd 01 	old
	REG_QWORD	76 bf 7a 82 4e 61 dd 01 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\HAM\AUI\App\V1\LU\	mod
PCT	REG_QWORD	69 ca 68 d8 4d 61 dd 01 	old
	REG_QWORD	80 ab e4 64 4f 61 dd 01 	new
PTT	REG_QWORD	69 75 a9 fc 4d 61 dd 01 	old
	REG_QWORD	ca 6a b6 88 4f 61 dd 01 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\HAM\AUI\SecHealthUI\V1\LU\	mod
ICT	REG_QWORD	2b c5 6c 14 24 55 dd 01 	old
	REG_QWORD	fc 8b 8d 20 4f 61 dd 01 	new
ITT	REG_QWORD	37 b7 0e 24 24 55 dd 01 	old
	REG_QWORD	16 f1 27 40 4f 61 dd 01 	new
PCT	REG_QWORD	39 ce 88 0e 24 55 dd 01 	old
	REG_QWORD	64 64 75 20 4f 61 dd 01 	new
PTT	REG_QWORD	45 0f 22 24 24 55 dd 01 	old
	REG_QWORD	5b 9b 30 40 4f 61 dd 01 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\HAM\AUI\App\V1\LU\	mod
ICT	REG_QWORD	c6 87 f5 0c 24 55 dd 01 	old
	REG_QWORD	71 a4 9b 25 4f 61 dd 01 	new
ITT	REG_QWORD	c2 be 9b 0e 24 55 dd 01 	old
	REG_QWORD	75 ef da 29 4f 61 dd 01 	new
PCT	REG_QWORD	03 c3 4f 08 24 55 dd 01 	old
	REG_QWORD	37 3e ed 1b 4f 61 dd 01 	new
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\	mod
05	00	00	00	09	00	00	00	00	00	00	00	01	00	00	00
01								05				00			
06	00	00	00	08	00	00	00	07	00	00	00	02	00	00	00
															
04	00	00	00	03	00	00	00	ff	ff	ff	ff				
															
MRUListEx	REG_BINARY		mod
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02	02	02	02	02	02	02	02	02	02	02	02	02	02	02
															
02	02											 ... (94)
												 ... (96)
NodeSlots	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\	mod
03	00	00	00	02	00	00	00	01	00	00	00	04	00	00	00
01				03				02							
00	00	00	00	ff	ff	ff	ff								
															
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\	mod
5	REG_BINARY	66 00 31 00 00 00 00 00 cc 56 7d 66 10 00 50 52 4f 43 45 53 7e 31 00 00 4e 00 09 00 04 00 ef be cc 56 7c 66 55 5d 87 5a 2e 00 00 00 96 a2 01 00 00 00  ... (104)	add
01	00	00	00	03	00	00	00	04	00	00	00	02	00	00	00
05				01				03				04			
00	00	00	00	ff	ff	ff	ff								
02				00	00	00	00	ff	ff	ff	ff				
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\1\5\	add
MRUListEx	REG_BINARY	ff ff ff ff 	add
NodeSlot	REG_DWORD	0x0000005f (95)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\	mod
1	REG_BINARY	56 00 31 00 00 00 00 00 45 5d 14 99 10 00 72 65 73 75 6c 74 73 00 40 00 09 00 04 00 ef be 45 5d 14 99 55 5d b8 5a 2e 00 00 00 e9 64 01 00 00 00 09 00  ... (88)	add
00	00	00	00	ff	ff	ff	ff								
01				00	00	00	00	ff	ff	ff	ff				
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\2\1\	add
MRUListEx	REG_BINARY	ff ff ff ff 	add
NodeSlot	REG_DWORD	0x00000060 (96)	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\9\	mod
02	00	00	00	01	00	00	00	00	00	00	00	ff	ff	ff	ff
01				02											
MRUListEx	REG_BINARY		mod
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\	add
ColInfo	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1  ... (136)	add
FFlags	REG_DWORD	0x00000001 (1)	add
GroupByDirection	REG_DWORD	0x00000001 (1)	add
GroupByKey:FMTID	REG_SZ	{00000000-0000-0000-0000-000000000000}	add
GroupByKey:PID	REG_DWORD	0x00000000 (0)	add
GroupView	REG_DWORD	0x00000000 (0)	add
IconSize	REG_DWORD	0x00000010 (16)	add
LogicalViewMode	REG_DWORD	0x00000001 (1)	add
Mode	REG_DWORD	0x00000004 (4)	add
Sort	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\95\Shell\	add
SniffedFolderType	REG_SZ	Generic	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\ComDlg\	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\	add
ColInfo	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fd df df fd 10 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 18 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1  ... (136)	add
FFlags	REG_DWORD	0x00000001 (1)	add
GroupByDirection	REG_DWORD	0x00000001 (1)	add
GroupByKey:FMTID	REG_SZ	{00000000-0000-0000-0000-000000000000}	add
GroupByKey:PID	REG_DWORD	0x00000000 (0)	add
GroupView	REG_DWORD	0x00000000 (0)	add
IconSize	REG_DWORD	0x00000010 (16)	add
LogicalViewMode	REG_DWORD	0x00000001 (1)	add
Mode	REG_DWORD	0x00000004 (4)	add
Sort	REG_BINARY	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 30 f1 25 b7 ef 47 1a 10 a5 f1 02 60 8c 9e eb ac 0a 00 00 00 01 00 00 00 	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\96\Shell\	add
SniffedFolderType	REG_SZ	Generic	add
HKEY_USERS\S-1-5-21-2292890337-69778762-837601055-1001_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache\	mod
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe.ApplicationCompany	REG_SZ	ThinPrint AG	add
C:\Users\user\Desktop\lab1\src\GreyEnergyDropper.exe.FriendlyAppName	REG_SZ	TPVCGateway Service	add
Больше возможностей при регистрации:
